Which integrations are available for this server?

Enables autonomous repository management by programmatically creating branches and committing dependency updates as part of the remediation process. Integrates with GitHub to scan repositories for vulnerabilities using the GitHub Advisory Database and automates the creation and management of pull requests for fixes. Provides specialized workflows for GitHub Actions to automate periodic vulnerability scanning and the dispatching of triage tasks.

How do I use Git-Fabric CVE?

This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.

Git-Fabric CVE

Official

by git-fabric

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

@git-fabric/cve

CVE detection-to-remediation fabric app. Scan, enrich, triage, and fix vulnerabilities across managed repos — autonomously.

Part of the git-fabric ecosystem. Built on the fabric-sdk OSI/BGP routing model.

Architecture

Five composable layers, each independently consumable:

Detection  →  Intelligence  →  Decision  →  Action  →  State
   │               │              │            │          │
   │  Scan deps    │  NVD enrich  │  Policy    │  Branch  │  JSONL queue
   │  query GHSA   │  CVSS/CWE    │  triage    │  commit  │  dedup
   │               │              │  plans     │  PR      │  stats
   └───────────────┴──────────────┴────────────┴──────────┴──────────

Layer	What it does	Side effects?
Detection	Reads dependency manifests, queries GitHub Advisory Database	No (produces findings)
Intelligence	Enriches CVEs from NVD with CVSS scores, status, CWE	No (pure data transform)
Decision	Applies severity policy, produces triage plans	No (pure logic)
Action	Creates branches, commits dependency bumps, opens PRs	Yes (writes to GitHub)
State	Manages the CVE queue (JSONL), dedup, filtering, stats	Yes (writes to state repo)

OSI Layer Mapping

The pipeline maps to the fabric-sdk OSI model:

Layer 7 — Application    app.ts (FabricApp factory, 8 tools)
Layer 6 — Presentation   bin/cli.js (Commander CLI + MCP stdio/HTTP, aiana_query)
Layer 5 — Session        layers/state.ts (JSONL queue, dedup, stats)
Layer 4 — Transport      MCP protocol (stdio + StreamableHTTP)
Layer 3 — Network        Gateway registration (AS65009, fabric.cve.*)
Layer 2 — Data Link      adapters/env.ts (Octokit + NVD API)
Layer 1 — Physical       GitHub API, NVD API

Related MCP server: Security-Use MCP Server

Quick Start

As an MCP Server (stdio)

# Set environment
export GITHUB_TOKEN="ghp_..."
export STATE_REPO="ry-ops/git-steer-state"
export MANAGED_REPOS="ry-ops/git-steer,ry-ops/blog"

# Start MCP server (stdio)
npx @git-fabric/cve start

As an HTTP MCP Server

# Start in HTTP mode with gateway registration
export MCP_HTTP_PORT=8209
export GATEWAY_URL="http://gateway.fabric-sdk:8080"
fabric-cve start

When MCP_HTTP_PORT is set, the server starts an HTTP listener with the following endpoints:

Endpoint	Method	Description
`/health`	GET	Health check (validates token + state repo)
`/tools`	GET	List available tools
`/tools/call`	POST	Call a tool by name
`/mcp`	POST	StreamableHTTP MCP endpoint

Claude Desktop Config

{
  "mcpServers": {
    "git-fabric-cve": {
      "command": "npx",
      "args": ["@git-fabric/cve", "start"],
      "env": {
        "GITHUB_TOKEN": "ghp_...",
        "STATE_REPO": "ry-ops/git-steer-state",
        "MANAGED_REPOS": "ry-ops/git-steer,ry-ops/blog"
      }
    }
  }
}

CLI

# Scan repos for vulnerable deps
fabric-cve scan --severity-threshold HIGH

# Enrich a single CVE from NVD
fabric-cve enrich CVE-2024-45519

# Triage pending queue entries (dry run)
fabric-cve triage --dry-run true

# Queue operations
fabric-cve queue list --status pending
fabric-cve queue stats

MCP Tools

Tool	Description
`cve_scan`	Scan managed repos for vulnerable dependencies via GHSA
`cve_enrich`	Fetch enriched details for a CVE from NVD
`cve_batch`	Batch enrich and rank multiple CVEs by severity
`cve_triage`	Process pending queue entries and open PRs per policy
`cve_queue_list`	List queue entries filtered by status/severity
`cve_queue_stats`	Queue health dashboard
`cve_queue_update`	Manually update entry status (e.g. skip with reason)
`cve_compact`	Compact queue by removing resolved entries past retention

Gateway Registration

fabric-cve registers as AS65009 with the fabric-sdk gateway. On startup in HTTP mode, it advertises the following BGP-style route prefixes:

Route Prefix	Description
`fabric.cve`	CVE detection, enrichment, triage, and remediation
`fabric.cve.scan`	Vulnerability scanning — repo dependency analysis via GHSA
`fabric.cve.enrich`	CVE enrichment — NVD details, CVSS, CWE, references
`fabric.cve.triage`	Triage — severity policy, auto-PR, queue processing
`fabric.cve.queue`	Queue management — list, stats, update, compact
`fabric.cve.intelligence`	Vulnerability intelligence across managed repos

All routes advertise with local_pref: 100 (deterministic lane). The gateway uses these prefixes to resolve natural language queries to the correct fabric without calling Claude.

Registration includes a 30-second keepalive interval. If the session expires (401), fabric-cve re-registers automatically.

aiana_query

The gateway's DNS resolver sends aiana_query requests to fabric-cve when a natural language question matches a fabric.cve.* prefix. fabric-cve maps these queries to real-time tool calls:

Natural language pattern	Tools called	Confidence
"active CVEs", "pending vulnerabilities"	`cve_queue_stats` + `cve_queue_list`	0.95
"triage status", "queue dashboard"	`cve_queue_stats`	0.90
"scan results", "detection findings"	`cve_queue_list` (status: all)	0.85
"critical findings", "high severity CVEs"	`cve_queue_list` (severity_min: CRITICAL)	0.90
"PRs opened", "remediation status"	`cve_queue_list` (status: pr_opened)	0.85
"errors", "failed triage"	`cve_queue_list` (status: error)	0.85
"health", "API connectivity"	`app.health()`	0.90
Reference questions ("how to", NVD docs)	Library lookup	0.60-0.92

If no live-data pattern matches, the query falls through to the Library for reference documentation. If the Library also misses, queue stats are returned as a fallback at confidence 0.50.

This keeps the three routing lanes intact: deterministic (>=0.95) answers from live tools, local-llm (>=floor) from Library context, and Claude as the 0.0.0.0/0 default route (last resort).

Severity Policy

The decision layer applies configurable policy:

Severity	Default Action	PR Type
CRITICAL	Auto-PR	Confirmed
HIGH	Auto-PR	Draft
MEDIUM	Skip	Manual review
LOW	Skip	Noise reduction

Override via CLI flags or MCP tool arguments:

fabric-cve triage \
  --auto-pr-threshold CRITICAL \
  --max-prs-per-run 3 \
  --require-patched-version true

Library

fabric-cve includes a built-in Library for reference documentation lookups. The Library fetches content on demand from upstream sources — no local copies stored permanently.

Source	Repository	Description
`github-advisory-database`	github/advisory-database	GHSA advisories, ecosystem docs
`nvd-api` / `vulnrichment`	cisagov/vulnrichment	CISA CVE enrichment data, CVSS, CWE
`osv-schema`	ossf/osv-schema	Open Source Vulnerability format spec

The Library is the second knowledge source checked by aiana_query — after live tool data but before escalating to Claude. It answers "how to" and "why" questions using upstream reference docs.

Environment Variables

Variable	Required	Description
`GITHUB_TOKEN`	Yes	GitHub token (or `GIT_STEER_TOKEN`)
`STATE_REPO`	Yes	State repo path (e.g. `ry-ops/git-steer-state`)
`MANAGED_REPOS`	Yes	Comma-separated repos to manage
`NVD_API_KEY`	No	NVD API key (raises rate limit 5 to 50 req/30s)
`MCP_HTTP_PORT`	No	Start HTTP server instead of stdio (e.g. `8209`)
`GATEWAY_URL`	No	Gateway registration endpoint (e.g. `http://gateway.fabric-sdk:8080`)
`POD_IP`	No	Pod IP for gateway `mcp_endpoint` (default: `0.0.0.0`)
`OLLAMA_ENDPOINT`	No	Ollama inference endpoint (default: `http://ollama.fabric-sdk:11434`)
`OLLAMA_MODEL`	No	Local LLM model for routing (default: `qwen2.5-coder:3b`)
`LIBRARY_DIR`	No	Cache directory for Library checkouts (default: `/tmp/fabric-library`)

GitHub Actions

Two workflows for autonomous operation:

cve-scan.yml — Weekly Monday scan, queries GHSA for all managed repos, queues findings
cve-triage.yml — Dispatch-only, reads queue, applies policy, opens PRs

The scan explicitly dispatches triage after completing — no push-trigger race condition.

Required Secrets & Variables

Name	Type	Description
`GIT_FABRIC_TOKEN`	Secret	GitHub token with repo + workflow access
`NVD_API_KEY`	Secret	NVD API key (optional, raises rate limit 5→50 req/30s)
`STATE_REPO`	Variable	State repo path (e.g. `ry-ops/git-steer-state`)
`MANAGED_REPOS`	Variable	Comma-separated repos to manage

Consuming from git-steer

git-steer can delegate to the fabric by implementing the GitHubAdapter and StateAdapter interfaces:

import { layers } from "@git-fabric/cve";

// Detection
const result = await layers.detection.detect(repos, "HIGH", githubAdapter);

// Queue
await layers.state.enqueue(result.findings, stateAdapter);

// Triage
const pending = await layers.state.pending(stateAdapter);
const plans = layers.decision.triage(pending, policy);
const results = await layers.action.execute(plans, githubAdapter);

Project Structure

src/
├── types.ts              # Shared types + adapter interfaces
├── index.ts              # Barrel export
├── app.ts                # FabricApp factory (8 tools, health check)
├── library.ts            # Reference doc retrieval (GHSA, NVD, OSV)
├── layers/
│   ├── detection.ts      # GHSA scanning + manifest parsing
│   ├── intelligence.ts   # NVD enrichment
│   ├── decision.ts       # Severity policy engine
│   ├── action.ts         # Branch + commit + PR creation
│   └── state.ts          # JSONL queue management
├── mcp/
│   └── server.ts         # MCP server (stdio, 7 tools)
└── adapters/
    └── env.ts            # Env var → Octokit + NVD adapter
bin/
└── cli.js                # Commander CLI + MCP stdio/HTTP + aiana_query

License

MIT

This server cannot be deployed

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

Maintenance

ActivityMaintained

ResponsivenessSyncing

Resources

Related MCP Connectors

Opzyai Pro
com.opzyai
Deep security scans of repos you own from your editor: dependency CVEs, SAST, git-history secrets.
Code Analysis Penetration Testing Security
2
https://www.opzyai.com/api/mcp/pro/mcp
Security Intel MCPA
com.datakoot
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Penetration Testing Security
51
https://security.datakoot.com/mcp
Security Intel MCPA
io.github.selflabbs
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Penetration Testing
2
https://security.selflabbs.com/mcp
Vulnerability Intel MCP
net.nexlab
Defensive vulnerability intelligence search across public CVE/NVD and GitHub advisory APIs with CVSS
Penetration Testing Security
1
https://mcp.nexlab.net/mcp/vulnerability-intel

Related MCP Servers

Trivy Security Scanner MCP
Testing & QA Tools Security Developer Tools
norbinsh
A
license
Not graded
quality
F
maintenance
Provides Trivy security scanning capabilities through a standardized interface, allowing users to scan projects for vulnerabilities and automatically fix them by updating dependencies.
Updated 2 years ago (2025-02-18 11:09 UTC)
10
MIT
Security-Use MCP Server
Security Testing & QA Tools Developer Tools
security-use
A
license
A
quality
D
maintenance
Enables AI assistants to scan project dependencies and Infrastructure as Code files for security vulnerabilities and misconfigurations. It also provides automated fixing capabilities to remediate identified security issues.
Updated 8 months ago (2026-03-01 13:30 UTC)
18
3
MIT
@4da/mcp-server
Security Developer Tools Code Analysis
4DA-Systems
A
license
A
quality
A
maintenance
Dependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.
Updated 6 hours ago (2026-11-07 04:22 UTC)
9
412 npm
2
Apache 2.0
CVE Search MCP Server
Security Penetration Testing
Arnabdaz
F
license
A
quality
D
maintenance
Enables searching and analyzing CVEs and vulnerabilities from multiple sources, optimized for PR review scenarios to help developers identify the latest security issues.
Updated 6 months ago (2026-04-28 12:17 UTC)
8
2
-