Install Dependency Vulnerability Tracker — package security advisories ($0.01/query) in ECA

What you need first

• ECA, installed.
• Nothing else: the server runs on its publisher's machines and ECA connects to it.

Steps

1. Open ~/.codex/config.toml, or create it. The Codex CLI, its IDE extension and the ChatGPT desktop app share this file.
2. Add this table at the end of the file.

{
  "mcpServers": {
    "data-dependency-vulnerability-malicious-package-security": {
      "url": "https://a2awire.com/mcp/data/ghsawatch-package-dependency-vulnerabilities-malicious-package-advisories-d21673/http"
    }
  }
}

3. Save the file and restart ECA.

Check it worked

Ask ECA: List the tools of data-dependency-vulnerability-malicious-package-security.

If it does not start

401 Unauthorized

The endpoint wants a sign-in or a key. Sign in when ECA asks.

Nothing changes after a restart

The file is not valid JSON any more. Look for a missing comma where the block was added.