aris-kg

Coding agents answer from training data that stops months before you use them. aris-kg connects them to the Aris knowledge graph instead: more than 15 million concepts, refreshed daily from NVD, OSV, GitHub security advisories, MITRE ATT&CK, OWASP and framework releases.

It comes three ways:

• An MCP server for Claude Code, Cursor, Codex, Windsurf and any other MCP client.

• A CLI that checks every pinned version in your lockfiles against known CVEs.

• A GitHub Action that fails a pull request when it adds a vulnerable dependency.

The code is open source (MIT). The graph is a paid API: you need a key from youraris.com/account, and each call is billed to your Aris credits.

Every account is limited to 120 calls a minute.

MCP server

The server gives your agent five tools, and tells it to use them without being asked: before adding a dependency, for any CVE, when picking a library version, and before writing auth, crypto, SQL or file-path code.

Claude Code

claude mcp add aris -e ARIS_API_KEY=your-key -- npx -y aris-kg mcp

Cursor, Windsurf and other JSON-configured clients

{
  "mcpServers": {
    "aris": {
      "command": "npx",
      "args": ["-y", "aris-kg", "mcp"],
      "env": { "ARIS_API_KEY": "your-key" }
    }
  }
}

Codex

In ~/.codex/config.toml:

[mcp_servers.aris]
command = "npx"
args = ["-y", "aris-kg", "mcp"]
env = { ARIS_API_KEY = "your-key" }

Related MCP server: agentseed

CLI

export ARIS_API_KEY=your-key

npx aris-kg audit                   # lockfiles in the current folder
npx aris-kg audit ./service --fail-on critical
npx aris-kg audit --json > report.json
npx aris-kg search cve CVE-2024-3094

audit reads package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, requirements.txt (pinned == lines), Cargo.lock and go.mod. It only checks exact versions, so use a lockfile rather than a manifest with ranges.

It exits with 1 when a vulnerability is at or above --fail-on (default high), or is exploited in the wild at any severity. --fail-on none never fails. Errors exit with 2.

GitHub Action

name: Dependency audit
on: [pull_request]
jobs:
  aris:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: kennysarnoski-jarvis/aris-kg@v0
        with:
          api-key: ${{ secrets.ARIS_API_KEY }}
          fail-on: high

As a library

import { ArisClient } from "aris-kg";

const aris = new ArisClient({ apiKey: process.env.ARIS_API_KEY! });
const report = await aris.checkDependencies([{ name: "lodash", version: "4.17.20", ecosystem: "npm" }]);

Development

npm install
npm test
npm run build
node dist/bin.js --help

Set ARIS_BASE_URL to point the client at another server.

License

MIT