Which integrations are available for this server?

Allows AI assistants to inspect FOSSA organizations and answer practical software composition analysis questions via the FOSSA API, including listing projects, retrieving dependencies, querying issues, and generating attribution reports.

How do I use fossa-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@fossa-mcp List my FOSSA projects with the most security issues." That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

fossa-mcp

by darthzen

Overview Schema Related Servers Score Discussions

Python

Remote

FOSSA MCP Server

A Model Context Protocol server for the FOSSA API that allows AI assistants to inspect FOSSA organizations and answer practical software composition analysis questions.

This version is read-only and does not modify FOSSA state.

Safety Statement

This version is read-only and does not modify FOSSA state.

Related MCP server: SonarQube MCP Server

Requirements

Python 3.11+
uv
Full FOSSA API token for live calls
Node/npm only when launching MCP Inspector through mcp dev

Setup

git clone <repo>
cd fossa-mcp
uv sync
cp .env.example .env

Then edit .env and add your FOSSA API token:

FOSSA_API_TOKEN=<your-full-api-token>

Validate

uv run pytest
uv run ruff check .
uv run ruff format --check .
uv run pyright

MCP Inspector

uv run mcp dev src/fossa_mcp/server.py

stdio

uv run fossa-mcp

Streamable HTTP

uv run fossa-mcp --transport streamable-http

Tools

Tool	Description
`fossa_list_projects`	List FOSSA projects visible to the current account
`fossa_get_project`	Get detailed metadata about exactly one FOSSA project
`fossa_list_project_revisions`	List analyzed revisions, branches, or tags for a project
`fossa_list_dependencies`	List dependencies detected in a specific project revision
`fossa_get_dependency`	Get the richer detail record for one dependency in one revision
`fossa_list_issues`	Query licensing, vulnerability, or quality issues globally or for one project revision
`fossa_get_issue`	Retrieve complete detail for one issue
`fossa_project_posture`	Provide one high-value, model-friendly view of a project revision's current FOSSA issue posture
`fossa_get_attribution_report`	Retrieve a text-friendly FOSSA attribution/SBOM report for a revision

Example Prompts

List my FOSSA projects sorted by security issues, highest first.

Show active critical and high vulnerabilities for revision <REVISION_LOCATOR>.

Compare revision <NEW_REVISION> with <OLD_REVISION> and show only new vulnerability issues.

Give me the FOSSA risk posture for project <PROJECT_LOCATOR> at revision <REVISION_LOCATOR>.

Generate the Markdown attribution report for revision <REVISION_LOCATOR>.

This server cannot be installed

license - permissive license

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/darthzen/fossa-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server