github.blogtoolGitHub Dependency Scanning MCP Server
GitHub's MCP Server now ships a "dependabot" toolset, in public preview, that lets MCP-compatible AI coding agents (Copilot Chat, Copilot CLI) scan dependency changes for known vulnerabilities before commit. The toolset queries the GitHub Advisory Database for affected packages, severity, and fixed versions, and can invoke the Dependabot CLI locally to diff dependency graphs pre/post-change for deeper post-commit checks. Requires Dependabot alerts enabled on the repo; setup involves enabling the toolset via Copilot CLI, VS Code MCP headers, or the advanced-security Copilot plugin.
TL;DR GitHub MCP Server's new dependabot toolset lets AI coding agents catch vulnerable dependencies pre-commit via the GitHub Advisory Database and Dependabot CLI diffing.
Technologies named here
- GitHub MCP Server
- GitHub Copilot CLI
- Dependabot CLI
- Visual Studio Code
- GitHub Advisory Database
- Dependabot
- advanced-security plugin for GitHub Copilot
- Model Context Protocol
- GitHub
- GitHub Copilot
- VS Code
Related in Supply Chain
