Open Source Supply Chain Risk MCP Server

@apifyforge

リポジトリホームページドキュメント

基本情報

カテゴリ

その他

ライセンス

MIT

認証方式

oauth

作者

apifyforge

Open Source Supply Chain Risk MCP Server について

Open source supply chain risk analysis via MCP — give your AI agent direct access to CVE records, CISA KEV exploits, maintainer bus-factor scores, and typosquat detection across 7 live intelligence sources.

Open Source Supply Chain Risk MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "open-source-supply-chain-risk-mcp": {
      "url": "https://ryanclinton--open-source-supply-chain-risk-mcp.apify.actor/mcp"
    }
  }
}

Open Source Supply Chain Risk MCP Server のツール

ツール一覧はまだありません

この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。

このサーバーは認証が必要です。ツールの取得にはログインや提供元の認証情報が必要な場合があります。

上のボタンでサーバーのエンドポイントに接続し、ツール一覧を取得できます。

概要

What is Open Source Supply Chain Risk?

An MCP server that analyzes open source supply chain risk through CVE records, CISA KEV exploits, maintainer bus-factor scores, and typosquat detection across seven live intelligence sources. It is built for security engineers, DevSecOps teams, and AI-assisted workflows requiring SBOM-grade risk intelligence within an AI client.

How to use Open Source Supply Chain Risk?

Add the server to your MCP client (e.g., Claude Desktop, Cursor, Windsurf) using the Streamable HTTP endpoint https://open-source-supply-chain-risk-mcp.apify.actor/mcp with your Apify API token in the Authorization: Bearer header. Start with the generate_oss_risk_report tool on a package or repository name.

Key features of Open Source Supply Chain Risk

Typed OSS dependency network graph with 7 node types
Maintainer bus-factor scoring with abandonment decay model
CVE blast radius estimation via BFS graph traversal
CISA KEV cross-referencing with active exploitation factor
Levenshtein typosquat detection across discovered repository names
5-factor weighted supply chain risk scoring (0–1)
Parallel queries across all 7 data sources (under 30 seconds)
5-minute in-process cache per session query

Use cases of Open Source Supply Chain Risk

DevSecOps pipeline gate – block PRs on high‑risk or exploited dependencies
SBOM audit and vendor risk management – generate reports with CISA remediation steps
Incident response triage – discover blast radius of a new critical CVE
Package vetting before adoption – compare maintainer health and risk scores
Supply chain attack early warning – monitor ArXiv papers and community discussion trends
Typosquat monitoring for package registries – detect malicious lookalike packages

よくある質問

What data sources does the server use?

It queries GitHub, NVD, CISA KEV, Hacker News, StackExchange, ArXiv, and Censys concurrently.

How much does a tool call cost?

Each MCP tool call costs $0.035 (USD) under the Apify platform pricing.

Which MCP clients are supported?

Any client supporting Streamable HTTP or SSE transport works, including Claude Desktop, Cursor, Windsurf, and Cline.

Is there caching to avoid duplicate upstream queries?

Yes, a 5‑minute in-process cache keyed by `source:query` reuses upstream data for repeated tool calls on the same package within a session.

How do I authenticate with the server?

Use your Apify API token as a Bearer token in the `Authorization` header when connecting to the endpoint.

「その他」の他のコンテンツ

Screenpipe

screenpipe

YC (S26) | Open Computer History | Continuously record your company computer work, map your workflows, help you find work worth automating, and power your agents' context

22.0K

ICSS

chokcoco

不止于 CSS

20.7K

Maestro

mobile-dev-inc

Painless E2E Automation for Mobile and Web

14.8K

Lemon.io

lemon-io

Request dedicated senior developers to work on your project, write job descriptions, and prep technical interviews — all without leaving your Claude chat. Just describe what you need, and Lemon.io MCP does the rest. 1–3

MaxKB

1Panel-dev

🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。