広告掲載
MCP.so
ログイン

Open Source Software Supply Chain MCP Server

@apifyforge

リポジトリホームページドキュメント

基本情報

カテゴリ

その他

ライセンス

MIT

認証方式

oauth

作者

apifyforge

Open Source Software Supply Chain MCP Server について

Open source supply chain risk assessment for AppSec teams, engineering leads, and platform engineers who need more than a CVE scanner. This MCP server aggregates 7 live data sources — GitHub, NVD, CISA KEV, StackExchange, Hacker News, Federal Register, and Congress.

Open Source Software Supply Chain MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "open-source-software-supply-chain-mcp": {
      "url": "https://ryanclinton--open-source-software-supply-chain-mcp.apify.actor/mcp"
    }
  }
}

Open Source Software Supply Chain MCP Server のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

このサーバーは認証が必要です。ツールの取得にはログインや提供元の認証情報が必要な場合があります。

上のボタンでサーバーのエンドポイントに接続し、ツール一覧を取得できます。

概要

What is Open Source Software Supply Chain?

Open Source Software Supply Chain is an MCP server that aggregates 7 live data sources—GitHub, NVD, CISA KEV, StackExchange, Hacker News, Federal Register, and Congress.gov—into a composite Dependency Risk Score (0-100) with machine‑readable verdicts from LOW_RISK to DO_NOT_USE. It is built for AppSec teams, engineering leads, and platform engineers who need supply chain risk intelligence beyond CVE scanning.

How to use Open Source Software Supply Chain?

Add the server URL (https://ryanclinton--open-source-software-supply-chain-mcp.apify.actor/mcp) to your MCP client (Claude Desktop, Cursor, Windsurf) with your Apify API token as Authorization: Bearer YOUR_TOKEN. Call any of the 8 tools—for example, dependency_risk_assessment with a package name like "lodash"—to receive a structured verdict, composite score, signals, and recommendations.

Key features of Open Source Software Supply Chain

  • Composite Dependency Risk Score using a weighted 4‑dimension formula
  • Maintainer bus factor analysis with contributor Gini coefficient
  • CISA KEV cross‑reference for active exploitation and ransomware use
  • SBOM regulatory compliance tracking from Federal Register and Congress.gov
  • Parallel execution of all 7 data sources with 120‑second timeouts
  • Hard‑override rule: CISA KEV + single‑point bus factor forces DO_NOT_USE

Use cases of Open Source Software Supply Chain

  • AppSec team dependency audits to prioritize transitive vulnerabilities
  • Engineering lead package selection comparing candidate libraries
  • SBOM compliance and procurement for federal mandate tracking
  • Security incident response cross‑referencing CVEs, KEV, and breach reports
  • CI/CD pipeline gates using machine‑readable verdicts
  • Vendor due diligence producing documented risk scores

よくある質問

1

What data sources does the server use?

It uses 7 sources: GitHub (bus factor, license, community), NVD (CVE severity), CISA KEV (active exploitation), StackExchange (Q&A), Hacker News (security mentions), Federal Register (regulatory), and Congress.gov (bills).

2

How is the composite risk score calculated?

The score uses a weighted formula: vulnerability exposure (35%), bus factor risk (25%), inverse community health (20%), and inverse SBOM compliance (20%). Sub‑scores for CVE severity, KEV entries, activity recency, and license copyleft are summed up to 100.

3

What verdicts can the server return?

Five verdicts: `LOW_RISK`, `ACCEPTABLE`, `REVIEW_NEEDED`, `HIGH_RISK`, and `DO_NOT_USE`. The hard‑override rule forces `DO_NOT_USE` if a package has both a CISA KEV entry and a `SINGLE_POINT` bus factor.

4

What is the pricing per tool call?

Each tool call costs $0.045. Spending limits are enforced per run to prevent runaway costs in automated pipelines.

5

Do I need a subscription or per‑seat license?

No. There is no subscription, no per‑seat pricing, and no CVE‑only blindspots. You pay per tool call ($0.045) and can use it with any MCP‑compatible client or API.

コメント

「その他」の他のコンテンツ

Volley.sh

Volley

A good sequence diagram can solve almost any communication problem in engineering. Volley lets your agent write them as plain text, with the real request and response payloads on every arrow. It checks its own syntax wi

YOUB

Connect your AI assistant to your own YOUB endurance training account. Read recorded activities with full analysis, planned sessions, race goals, wellness (HRV, sleep, resting HR) and your athletic profile. Create or mov

MaxKB

1Panel-dev

🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。

22.0K

Senso MCP for Joomla

sensomedia

Senso MCP turns a Joomla 5 or 6 site into a remote MCP server. It runs inside Joomla itself (no extra server, no Node.js bridge) and is secured with OAuth 2.1 and Joomla's own ACL. The free pack lets an AI assistant crea

DeepMark

DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.

広告掲載