广告合作
MCP.so
登录

Open Source Software Supply Chain MCP Server

@apifyforge

代码仓库主页文档

基本信息

分类

其他

许可证

MIT

认证方式

oauth

作者

apifyforge

关于 Open Source Software Supply Chain MCP Server

Open source supply chain risk assessment for AppSec teams, engineering leads, and platform engineers who need more than a CVE scanner. This MCP server aggregates 7 live data sources — GitHub, NVD, CISA KEV, StackExchange, Hacker News, Federal Register, and Congress.

Open Source Software Supply Chain MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "open-source-software-supply-chain-mcp": {
      "url": "https://ryanclinton--open-source-software-supply-chain-mcp.apify.actor/mcp"
    }
  }
}

Open Source Software Supply Chain MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

此服务需要认证，获取工具列表可能需要登录或使用服务提供方的凭据。

点击上方按钮,直接连接服务器端点实时获取工具列表。

概览

What is Open Source Software Supply Chain?

Open Source Software Supply Chain is an MCP server that aggregates 7 live data sources—GitHub, NVD, CISA KEV, StackExchange, Hacker News, Federal Register, and Congress.gov—into a composite Dependency Risk Score (0-100) with machine‑readable verdicts from LOW_RISK to DO_NOT_USE. It is built for AppSec teams, engineering leads, and platform engineers who need supply chain risk intelligence beyond CVE scanning.

How to use Open Source Software Supply Chain?

Add the server URL (https://ryanclinton--open-source-software-supply-chain-mcp.apify.actor/mcp) to your MCP client (Claude Desktop, Cursor, Windsurf) with your Apify API token as Authorization: Bearer YOUR_TOKEN. Call any of the 8 tools—for example, dependency_risk_assessment with a package name like "lodash"—to receive a structured verdict, composite score, signals, and recommendations.

Key features of Open Source Software Supply Chain

  • Composite Dependency Risk Score using a weighted 4‑dimension formula
  • Maintainer bus factor analysis with contributor Gini coefficient
  • CISA KEV cross‑reference for active exploitation and ransomware use
  • SBOM regulatory compliance tracking from Federal Register and Congress.gov
  • Parallel execution of all 7 data sources with 120‑second timeouts
  • Hard‑override rule: CISA KEV + single‑point bus factor forces DO_NOT_USE

Use cases of Open Source Software Supply Chain

  • AppSec team dependency audits to prioritize transitive vulnerabilities
  • Engineering lead package selection comparing candidate libraries
  • SBOM compliance and procurement for federal mandate tracking
  • Security incident response cross‑referencing CVEs, KEV, and breach reports
  • CI/CD pipeline gates using machine‑readable verdicts
  • Vendor due diligence producing documented risk scores

常见问题

1

What data sources does the server use?

It uses 7 sources: GitHub (bus factor, license, community), NVD (CVE severity), CISA KEV (active exploitation), StackExchange (Q&A), Hacker News (security mentions), Federal Register (regulatory), and Congress.gov (bills).

2

How is the composite risk score calculated?

The score uses a weighted formula: vulnerability exposure (35%), bus factor risk (25%), inverse community health (20%), and inverse SBOM compliance (20%). Sub‑scores for CVE severity, KEV entries, activity recency, and license copyleft are summed up to 100.

3

What verdicts can the server return?

Five verdicts: `LOW_RISK`, `ACCEPTABLE`, `REVIEW_NEEDED`, `HIGH_RISK`, and `DO_NOT_USE`. The hard‑override rule forces `DO_NOT_USE` if a package has both a CISA KEV entry and a `SINGLE_POINT` bus factor.

4

What is the pricing per tool call?

Each tool call costs $0.045. Spending limits are enforced per run to prevent runaway costs in automated pipelines.

5

Do I need a subscription or per‑seat license?

No. There is no subscription, no per‑seat pricing, and no CVE‑only blindspots. You pay per tool call ($0.045) and can use it with any MCP‑compatible client or API.

评论

其他 分类下的更多 MCP 服务器

Activepieces

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

23.2K

Sequential Thinking

modelcontextprotocol

Model Context Protocol Servers

88.2K

Soar Flight Booking MCP

Soar Flight Booking MCP is a remote MCP server available at https://mcp.soar.flights.

ICSS

chokcoco

不止于 CSS

20.7K

Yuppsy

Yuppsy MCP: build and publish real estate websites from your AI assistant. Yuppsy lets your AI assistant create live websites for real estate agents and individual property listings. You don't need a designer or any code

广告合作