Hound MCP Server - install, status & alternatives [2026]

01 · Install Hound

Claude Code

claude mcp add tiluckdave-hound-mcp -- npx -y hound-mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "tiluckdave-hound-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "hound-mcp"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license MIT - declared in the repository

npm package hound-mcp - unscoped; check the name against the project README before installing

registry namespace io.github.tiluckdave is GitHub-verified and matches the repo owner

03 · What Hound can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can find the minimum safe version upgrade that resolves all known vulns, scan a lockfile for license compliance against a policy, detect typosquatting variants of a package name, and scan popular packages for known vulnerabilities.

The 11 tools it gives your agent

Extracted from the project's README - what hound lets an agent do.

hound_score: - 0–100 Hound Score (vulns + scorecard + recency + license) with letter grade
hound_compare: - Side-by-side comparison of two packages with a recommendation
hound_preinstall: - GO / CAUTION / NO-GO verdict before installing a package
hound_upgrade: - Find the minimum safe version upgrade that resolves all known vulns
hound_license_check: - Scan a lockfile for license compliance against a policy
hound_vulns: - All known vulnerabilities for a package version, grouped by severity
hound_inspect: - Full package profile - license, vulns, scorecard, stars, dep count
hound_tree: - Full resolved dependency tree with transitive deps
hound_typosquat: - Detect typosquatting variants of a package name
hound_advisories: - Full advisory details by GHSA, CVE, or OSV ID
hound_popular: - Scan popular packages for known vulnerabilities

Latest releases

v0.3.0 · 2026-07-03

add direct generateTypos coverage · ignore .omo agent artifacts and ungroup dependabot majors · Improve unsupported lockfile error messages · Add pubspec.lock parser support · integrate CodeQL workflow for automated…

v0.2.4 · 2026-05-23

Fix numbered list in CONTRIBUTING.md · Apply consistent formatting across documentation · Code Quality · Format source files with prettier · Format test files with prettier · Update pnpm-lock.yaml format · Add…

v0.2.3 · 2026-03-23

demo video · bump typescript-eslint from 8.57.0 to 8.57.1 in the dev-dependencies group · centralize license + ecosystem values as constants · Fix hardcoded version strings drifting out of sync · Add coverage…

04 · Who maintains Hound

hound is maintained by tiluckdave. It's the only MCP server we track from this author; the repo dates to Mar 2026.

05 · Facts

repository: github.com/tiluckdave/hound-mcp
category: security - ranked #65 of 182 actively-maintained security servers as of 2026-08-25.
release cadence: 1 release in the last 90 days (latest 2026-07-03)
registry: io.github.tiluckdave/hound (active, first published 2026-03-11)
packages: npm:hound-mcp

06 · Hound FAQ

Is Hound still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-05 and it shipped 1 release in the last 90 days. We re-verify nightly.

What can Hound do?

With this server connected, an agent can find the minimum safe version upgrade that resolves all known vulns, scan a lockfile for license compliance against a policy, detect typosquatting variants of a package name, and scan popular packages for known vulnerabilities.

How do I install Hound?

Run `npx -y hound-mcp`. You can also paste the ready-made client config above.

Does Hound run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Hound

Alternatives to Hound

Maintained security servers if Hound isn't the fit.

Pairs well with

Servers that cover what Hound doesn't - only shown when the pairing reason fits the companion.

More security MCP servers · NeuroDock (hosted) · Scopeblind MCP · Trestle · Trackly CLI · Agent Abilities for MCP

More TypeScript MCP servers · Sessionplan · Hotkeyless AHK MCP Skill · Tiger Skills · Styx MCP Server · remem-MCP - Local-first MCP Memory + CodeGraph + Wiki · see all