Skip to main content
Glama
Sign In
mcp-supply-chain-check

mcp-supply-chain-check

by MuellerMH
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

Related Servers

Alternatives to mcp-supply-chain-check

No user-submitted related servers found.

    Related Servers

    • OSV Dependency Vulnerability

      fairquery
      A
      license
      A
      quality
      A
      maintenance
      Enables AI agents to submit npm, PyPI, Go, or Maven packages and manifests to the free OSV.dev database and receive per-package and per-advisory results with CVE mappings, CVSS scores, severities, and the versions that fix each issue. It also supports filtering by minimum severity, de-duplicating alias advisories, and machine-readable error/warning rows for CI gates and upgrade recommendations.
      3
      MIT

    • mcp-osv

      pipeworx-io
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI agents to look up known open-source vulnerabilities in the OSV.dev database, covering individual packages and versions, specific git commits, single vulnerability IDs, and batch SBOM-style dependency scans. Queries are keyless and return compact summaries or full vulnerability details with affected ranges and references.
      412 npm
      MIT
    • @guardbee/mcp-dependency-auditor

      @guardbee/mcp-dependencyofficial

      GuardBee
      A
      license
      Not graded
      quality
      F
      maintenance
      Enables auditing npm, pip, and other package dependencies for known CVEs via the OSV database, with tools to scan manifests, query individual packages, and integrate into CI/CD workflows.
      785 npm
      MIT

    • PkgGuard

      Duffey234
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI coding agents to scan dependency manifests or package lists against OSV.dev for known vulnerabilities and confirmed-malicious packages, returning severity, CVSS and fixed versions while keeping manifests local. Runs as a hosted or local stdio MCP server with a free daily tier and optional per-call x402 payments.
      14 npm
      MIT

    • GuardianMCP

      Kalvisan
      A
      license
      A
      quality
      D
      maintenance
      Automatically scans project dependencies (npm, Composer) for security vulnerabilities using the OSV.dev database, providing real-time alerts and detailed remediation guidance directly in your IDE.
      1
      7 npm
      1
      MIT
    Deploy Server
    Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

    TDQS

    A3.8/5.0

    Scored across 2 tools

    Disambiguation5/5

    check_package targets one ecosystem/name/version tuple, while check_sbom targets a local SBOM file and batch-resolves its components. The input types and scopes are explicitly disjoint, leaving no realistic way to confuse them.

    Naming Consistency5/5

    Both tools follow the same verb_noun convention (check_package, check_sbom) in snake_case with the shared verb 'check'. Fully predictable pattern.

    Tool Count3/5

    Two tools cover the two natural granularities (single component vs. whole SBOM), so each earns its place, but the surface is thin for a 'supply-chain-check' server. There is no room for related operations like manifest/lockfile scanning or advisory detail lookup, making the set feel under-scoped.

    Completeness4/5

    Core lifecycle for vulnerability checking is covered: ad-hoc single-package lookup plus batch SBOM verification with truncation handling. Minor gaps remain (no lockfile/manifest input such as package.json or requirements.txt, and no way to fetch deeper advisory detail or remediation info), but agents can work around these by looping check_package.

    Maintenance

    ActivityMaintained
    ResponsivenessSyncing

    Resources