Attestd - Deterministic CVE & Supply Chain Data MCP Server

@attestd-io

リポジトリ

基本情報

ライセンス

MIT

トランスポート

stdio

作者

attestd-io

投稿者

Robert Marshall

Attestd - Deterministic CVE & Supply Chain Data MCP Server について

Deterministic, machine-readable CVE and supply chain risk data for infrastructure, PyPI, and npm packages. Built for AI agents and coding assistants to act on directly, no CVSS interpretation required. Covers nginx, PostgreSQL, Redis, Docker, Kubernetes, and more.

#security #cve #supply-chain #vulnerability #npm #pypi #ai-agents

Attestd - Deterministic CVE & Supply Chain Data MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "attestd": {
      "command": "npx",
      "args": [
        "-y",
        "@attestd/mcp"
      ],
      "env": {
        "ATTESTD_API_KEY": "<YOUR_API_KEY>"
      }
    }
  }
}

Attestd - Deterministic CVE & Supply Chain Data MCP Server のツール

Check whether a software package or infrastructure product version has known CVE vulnerabilities or a confirmed supply chain compromise. Call this before adding, updating, or recommending any npm, PyPI, or infrastructure dependency, including mid-conversation when a developer asks about installing or upgrading a package. outsideCoverage=true means Attestd has no data for that product; treat as unknown risk, not safe. Covers infrastructure products (nginx, PostgreSQL, Redis, Docker, Kubernetes, etc.) and PyPI/npm packages.

Returns infrastructure product slugs covered by Attestd for CVE checks. PyPI and npm packages also work with check_package_vulnerability even when absent from this list. Call this first if you are unsure whether an infrastructure slug is supported. Uses a static bundled list. No /v1/check API call for this tool.

Check up to 100 software packages or infrastructure products in a single request. Each item is billed as one API call. Use this instead of multiple check_package_vulnerability calls when you need to audit a lockfile, manifest, or dependency list. Items outside Attestd coverage return outsideCoverage=true and should be treated as unknown risk, not safe. A 429 is returned before any results are delivered if the batch would exceed your monthly quota; no calls are billed in that case.

概要

What is Attestd - Deterministic CVE & Supply Chain Data?

Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response. This MCP server exposes these checks as tools for Claude Code, Claude Desktop, and any MCP-compatible client.

How to use Attestd - Deterministic CVE & Supply Chain Data?

Run the server via npx -y @attestd/mcp and configure an API key in the ATTESTD_API_KEY environment variable inside your MCP client’s configuration (e.g., ~/.claude/mcp.json). The server exposes four tools: check_package_vulnerability, check_batch_vulnerabilities, list_covered_products, and get_cve_details.

Key features of Attestd - Deterministic CVE & Supply Chain Data

Check a single package version for CVEs and supply-chain risks
Batch-check up to 100 packages in one call (lockfile/manifest audits)
Query covered products (live or static bundled list)
Retrieve full CVE details including CVSS, EPSS, CISA KEV status
Structured JSON response with risk state, patch guidance, and confidence

Use cases of Attestd - Deterministic CVE & Supply Chain Data

Automatically audit a project’s dependencies before deployment
Scan lockfiles or manifests for known vulnerabilities
Investigate specific CVE identifiers for enterprise risk assessment
Monitor supply-chain compromise signals (typosquat, PyPI/npm alerts)

よくある質問

What are the prerequisites?

Node.js 18+ and an Attestd API key (free from the portal) are required for most tools.

Can I use the server without an API key?

`list_covered_products` returns a static bundled list without a key; all other tools require a valid API key.

How many packages can I check in a single batch?

Up to 100 items per call. Each item counts toward your API quota, and the quota is checked before any calls are billed.

What happens if the API key is invalid or rate‑limited?

The tool returns `isError: true` with a JSON `error` string.

What data does check_package_vulnerability return?

It returns risk state, CVE IDs, CISA KEV signal, remote exploitability, patch availability, supply-chain compromise flags, and more.

マーケットプレイスの他のコンテンツ

LocalCan

Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.

Kin

Troy Fortin, Jr. (Firelock, LLC)

The system of record for AI-written software. A persistent graph of entities, relationships, changes, and provenance, so humans and AI agents see what a change touches before it merges. Beside Git today.

OpenZiti MCP Gateway

openziti

NetFoundry MCP Gateway enables secure, isolated access to Model Context Protocol (MCP) tools across distributed systems without exposing public endpoints. Zero trust gateway for MCP servers. Aggregate, filter, and secure

OpenLore

aakarim

Serve your docs to AI agents over SSH and MCP. Agents use ls, cat, grep, find, and pipes against a virtual filesystem backed by your documentation. Identity-scoped access, governed writing with human approval, and portab

Local MCP (LMCP)

lanchuske

Local tools that let your AI use Mail, Calendar, Contacts, Teams, Slack, WhatsApp, OneDrive, Google Drive, Notion, Outlook and Office files on Mac and Windows. Runs on your computer.