What can you do with this server?

TridentChain MCP is a local-first supply-chain security scanner that ranks vulnerabilities by real-world exploit risk. * Scan npm/PyPI project dependencies for CVEs and prioritize findings using EPSS and CISA KEV, returning JSON and HTML reports. * Run comprehensive scans covering project dependencies, OS/system packages, and IDE extensions such as VS Code and JetBrains. * Validate after patching by comparing baseline and post-patch scan results to confirm resolved, remaining, and new findings. * Support full, quick, and offline scan profiles, with no API key required for default usage.

Which integrations are available for this server?

Uses GitHub Security Advisories (GHSA) as an optional vulnerability intelligence source, with GITHUB_TOKEN enabling GHSA advisory coverage. Scans installed Linux system packages via apt/dnf as part of full audits, alongside project dependencies and IDE extensions. Scans installed macOS system packages via Homebrew as part of full audits, alongside project dependencies and IDE extensions. Scans npm manifests and lockfiles for vulnerable dependencies and CVEs, ranking findings by EPSS exploit probability and CISA KEV presence. Scans PyPI manifests and lockfiles for vulnerable Python dependencies and CVEs, ranking findings by EPSS exploit probability and CISA KEV presence. Uses Sonatype Guide advisories as an optional vulnerability intelligence source via SONATYPE_TOKEN.

TridentChain Security

TridentChain Security MCP server

Local-first vulnerability scanner for project dependencies, developer tools, and IDE extensions.
Uses multi-source intelligence (OSV, NVD, GHSA, Sonatype) with KEV/EPSS prioritization.

No API key required for default usage.

Public repo: https://github.com/DevInder1/supply-chain-scanner-public

Install (plug and play)

pip3 install tridentchain-security
npm install -g @tridentchain/security-cli
tridentchain-security --help

Agents & MCP (Claude, Cursor, VS Code, Windsurf, Zed):

Pick whichever install path fits:

# Option A — pip (needs Python 3.10+)
pip3 install -U "tridentchain-security>=0.1.4" "tridentchain-mcp>=0.1.4"

# Option B — uvx (no manual Python install; uv handles it)
uvx tridentchain-mcp

# Option C — Docker (no Python needed, fully sandboxed)
docker pull ghcr.io/devinder1/tridentchain-mcp:latest
# Then in your MCP config, replace `python3 -m tridentchain_mcp` with:
#   command: docker
#   args: ["run", "--rm", "-i", "-v", "$PWD:/workspace", "ghcr.io/devinder1/tridentchain-mcp:latest"]

What you can do: docs/CAPABILITIES.md
Full guide: docs/INSTALL_AND_USE.md
Cross-platform (macOS / Linux / Windows): docs/CROSS_PLATFORM.md
(PyPI: tridentchain-security · npm: @tridentchain/security-cli)

tridentchain-security --scan all --project-path . --output-dir scanner-output

Related MCP server: GoThreatScope

Use in your own Python app

from scanner import run_scan

summary = run_scan(
    project_path=".",
    scan="all",
    run_profile="full",  # no API key required
    output_dir="scanner-output",
)
print(summary["summary"])

Scan profiles

Profile	Description
`full` (default)	Project + system + extensions. OSV + NVD without keys.
`quick`	Faster project-focused scan.
`offline`	Local advisory DB only, no network.
Power-user	Add `GITHUB_TOKEN`, `NVD_API_KEY`, optional `SONATYPE_TOKEN` for best coverage.

Desktop app (individual application)

No repo clone required if the pip package is installed:

pip3 install tridentchain-security
cd apps/desktop && npm install && npm run start

See apps/desktop/README.md and docs/DISTRIBUTION_VERIFICATION.md.

AI / automation (Claude, OpenAI, Cursor, VS Code, Windsurf, …)

One install, every agent: pip install "tridentchain-security>=0.1.2" tridentchain-mcp

Guide	Description
Agent integrations	Claude · OpenAI · Cursor · VS Code · Windsurf · Zed · MCP · CLI
Capabilities	Everything you can do today
Architecture	MCP + unified tools design

./scripts/setup-agent-mcp.sh cursor   # prints setup for your agent

Phase 2 — Claude MCP: pip install tridentchain-mcp · Setup guide · Plugin

Phase 3 — OpenAI + Cursor: examples/openai/ · Cursor setup · .cursor/mcp.json.example

Phase 4 — VS Code (Anthropic MCP): Open repo → MCP ready · VS Code setup · ./scripts/vscode-mcp-install-link.sh · extension

Phase 5 — Validate: tridentchain-security --validate · MCP validate_after_patch · CAPABILITIES.md

Unified tool layer: from scanner.integrations import execute_tool, get_tool_definitions, to_openai_tools

Development

git clone https://github.com/DevInder1/supply-chain-scanner-public.git
cd supply-chain-scanner-public
python3 -m pip install -e .
tridentchain-security --help
python3 -m unittest scanner.tests.test_matcher_ranges -v

Install & use: docs/INSTALL_AND_USE.md
Cross-platform: docs/CROSS_PLATFORM.md
CLI contract: docs/cli-contract.md
Publishing: docs/PUBLISHING.md

Optional API keys (power users)

Variable	Purpose
`NVD_API_KEY`	Higher NVD rate limits
`GITHUB_TOKEN`	GHSA advisories
`SONATYPE_TOKEN`	Sonatype Guide advisories

Set in .env or environment variables.

License

MIT — see LICENSE

Available Tools

3 tools

scan_fullA

Comprehensive scan covering THREE surfaces in one call that project-only scanners cannot reach: (1) project dependencies (npm, PyPI), (2) OS/system packages (Homebrew on macOS, apt/dnf on Linux), and (3) installed IDE extensions (VS Code marketplace + JetBrains plugins). Use this whenever the user asks for "complete coverage", a "full audit", scanning their "whole machine" or "system", or wants to check IDE extensions — these are a growing attack vector and most other vulnerability scanners miss them entirely. Slower than scan_project; pick scan_project for fast project-only checks. Findings are ranked by EPSS exploit probability and CISA KEV presence so the user sees what attackers are actually using first. Returns JSON plus HTML reports under output_dir.

Inputs: project_path (required), output_dir, run_profile, max_findings. Returns: result

scan_projectA

Scan project dependencies for CVEs and rank findings by REAL-WORLD EXPLOITATION RISK using EPSS (exploit probability) and the CISA KEV (Known Exploited Vulnerabilities) catalog — not just CVSS severity. Best for: when the user wants to know which CVEs to fix FIRST, asks about supply-chain risk in an IDE/conversational context, or wants to pair with validate_after_patch for a confirmed-fix workflow. Covers npm and PyPI manifests + lockfiles. For comprehensive coverage that also includes OS packages and IDE extensions, prefer scan_full. Returns JSON with status, EPSS-ranked findings list, and paths to HTML reports written under output_dir.

Inputs: project_path (required), output_dir, run_profile, max_findings. Returns: result

validate_after_patchA

Read-only

Confirm that dependency upgrades actually resolved the CVEs they were supposed to fix. Use this whenever the user says they ran npm update, pip install -U, or applied a patch and wants verification — chain it with two scan_project calls (before/after) or pass two saved scan JSON results. This is unique to TridentChain; most other supply-chain scanners only report findings without a verifiable post-patch loop. Returns resolved_count, remaining_count, new_count, and validation_passed (true only when new findings == 0 and at least one was resolved).

Inputs: baseline_json (required), after_patch_json (required). Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

TDQS

A4.3/5.0

Scored 2026-07-29 17:00 across 3 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: scan_project for project-only dependencies, scan_full for comprehensive coverage including system and IDE extensions, and validate_after_patch for post-patch verification. Descriptions explicitly differentiate use cases.

Naming Consistency5/5

All tool names follow a consistent verb_noun snake_case pattern: scan_project, scan_full, validate_after_patch. The naming is predictable and descriptive.

Tool Count4/5

With 3 tools, the server is minimal but well-scoped for its vulnerability scanning and validation domain. Each tool earns its place, though the count is on the lower end.

Completeness4/5

The server covers the core workflow: scanning project or full system and validating fixes. Minor gaps exist, such as lacking a tool to configure output paths or list past scans, but the primary use cases are handled.

Maintenance

ActivityMaintained

ResponsivenessOutdated data

Resources

Related MCP Connectors

DepScoutA
io.github.yc-droid
Scan packages and lockfiles (npm, PyPI, Go, Maven, Cargo, NuGet) for vulnerabilities and malware.
Security Penetration Testing Developer Tools
41
https://depscout.salesup.workers.dev/mcp
Security Intel MCPA
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
51
https://security.datakoot.com/mcp
Security Intel MCPA
io.github.selflabbs
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Penetration Testing
2
https://security.selflabbs.com/mcp
cve-intel-mcpA
io.github.robertoyanguas-ops
Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and re
Security Penetration Testing Developer Tools
21
https://cve-intel-72343955726.us-central1.run.app/mcp/cve-intel

Related MCP Servers

GuardianMCP
Developer Tools Security Testing & QA Tools
Kalvisan
A
license
A
quality
D
maintenance
Automatically scans project dependencies (npm, Composer) for security vulnerabilities using the OSV.dev database, providing real-time alerts and detailed remediation guidance directly in your IDE.
Updated a year ago (2025-11-26 11:18 UTC)
1
8 npm
1
MIT
GoThreatScope
Security Developer Tools Code Analysis
anotherik
A
license
Not graded
quality
D
maintenance
Go-based SBOM, vulnerability, and secret scanner with MCP support.
Updated 9 months ago (2026-02-11 00:36 UTC)
3
Apache 2.0
dep-guard-mcp
Security CI/CD & DevOps Code Analysis
mdjahidanwar
F
license
Not graded
quality
D
maintenance
Scans Python, Node.js, Java/Spring, and PHP dependency manifests for known vulnerabilities using OSV and GitHub Advisory APIs.
Updated 7 months ago (2026-03-29 19:29 UTC)
-
deptrustofficial
Security Developer Tools
clidey
A
license
Not graded
quality
B
maintenance
deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and more. It runs locally as a CLI and as an MCP server. It calls public package registry and OSV APIs directly; there is no hosted deptrust service to trust or configure.
Updated 9 days ago (2026-11-02 03:46 UTC)
95 npm
61
MIT