MCP Maintainer Tools
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NVD_API_KEY | No | Optional NVD API key. Can be supplied through the server process environment or your client's secret settings. Keep the key out of repository files, example configurations, and diagnostic output. | |
| MCP_MAINTAINER_TOOLS_TRUST_ENV | No | By default, the transport ignores environment proxy and custom-CA settings. If your network requires them, explicitly set MCP_MAINTAINER_TOOLS_TRUST_ENV=true in the server environment and supply only trusted proxy/CA settings. TLS verification remains enabled. Restart the server after changing the setting. | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| osv_queryB | Fetch one OSV page for a package version. Repeat with next_page_token until has_more is false. |
| osv_batchC | One OSV page per package: [{name, version, ecosystem?, page_token?}], at most 100. Follow each token separately. |
| osv_vulnA | Get an OSV record, retaining package-specific affected ranges, fixed events, and references. |
| nvd_cveB | Get an NVD CVE, preserving metric-source attribution. Optional NVD_API_KEY is read from the environment. |
| kev_checkA | Check up to 100 CVEs against a freshly fetched CISA KEV catalog. Absence is not proof of no exploitation. |
| epssA | Fetch one FIRST EPSS page for up to 100 CVEs. Scores estimate exploitation probability, not environment-specific risk. |
| depsdev_packageC | Get deps.dev version metadata. Only a provider-marked default is used; no latest-version guess is made. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool maps to a distinct data source or operation: OSV package-page query, OSV record lookup, OSV batch query, NVD CVE lookup, CISA KEV check, EPSS scoring, and deps.dev package metadata. The OSV trio is the closest overlap, but their descriptions distinguish single-page query, record retrieval, and multi-package batching well enough.
All names use snake_case, which is helpful, but the patterns are mixed: some are source-prefixed with an action or object (osv_query, osv_vuln, osv_batch, nvd_cve, kev_check, depsdev_package), while epss is just a bare acronym. The convention is readable but not consistently predictable across the set.
Seven tools is well-scoped for a vulnerability and dependency-intelligence server, with each tool covering a meaningful source or operation. There is no obvious filler or excessive breadth.
The surface covers vulnerability lookup across OSV, NVD, KEV, and EPSS plus deps.dev package metadata, which supports common security-maintenance workflows. Minor gaps remain, such as higher-level dependency graph or package-version resolution support, but agents can work around them with existing tools.