Audito plugs into Claude Code, Cursor, and any MCP client — flagging typosquats, deprecations, and known CVEs before they touch your lockfile, then fixing what's already there without leaving your workflow.
The agent picks the dependency. Audito makes sure the pick isn't a footgun — at install time, in CI, and forever after.
Your agent asks Audito before it writes a new dep. Typosquats, deprecations, known CVEs, and license mismatches get an allow / warn / block verdict with a plain-English summary — across npm, PyPI, crates.io, and Go.
Likely typosquat of colors. Registered 6 days ago, 0 weekly downloads, no repo. Try chalk instead.
Audit an entire lockfile in one call — npm, pnpm, yarn (classic + berry), requirements.txt, poetry, Pipfile, Cargo, and go.sum. Eight formats, one tool.
Audito computes the nearest safe upgrade per CVE — a minimal, operator-preserving manifest edit and the exact per-ecosystem install command, with breaking changes flagged. Your agent applies it; you review and merge.
A GitHub Action and an installable App post an Audito Check Run with inline per-package annotations. Malware and CRITICAL/HIGH block; the App can open remediation PRs.
A daily OSV.dev scan keeps your inventory current; CRITICAL and HIGH findings email you immediately — not at the end of the week.
License allow / warn / block on SPDX IDs, 30-day posture trends, a findings inbox with accept / dismiss / snooze triage, and a Monday digest of what changed.
One line in Claude Code. Cursor and Claude Desktop work too over mcp-remote. Authenticate with an audt_… token — no SDK, no CI step required.
claude mcp add audito --remote …
Pre-install, the agent asks Audito before writing the package. Post-install, a daily scan keeps watching what's already there and alerts you when something new lands.
Audito returns the nearest safe upgrade; your agent applies it, or the GitHub App opens a draft remediation PR. You review and merge.
Free covers 3 libraries on npm + PyPI with real-time alerts. Pro unlocks lockfile audits, the GitHub CI gate, all four ecosystems, and license policies — 14-day free trial, no card, starting at signup.
Connect Audito to Claude Code or Cursor in a minute. The next package your agent reaches for, you'll know whether it's safe before it lands.