What can you do with this server?

Attestd MCP server lets MCP clients check dependency versions for CVE risks and supply-chain compromises, inspect CVE details, list covered products, and monitor API usage. * check_package_vulnerability: Check a single product/version for known CVEs, risk state, exploit signals, patch guidance, typosquat, and supply-chain compromise. * check_batch_vulnerabilities: Audit up to 100 packages/versions in one call, each billed as one API call, with upfront quota check and 429 if over quota. * list_covered_products: Get CVE infrastructure products and monitored PyPI/npm supply-chain packages (live with API key, static bundled list without). * get_cve_details: Retrieve CVSS, EPSS, KEV status, affected products, and timestamps for a specific CVE ID. * get_usage: View remaining monthly quota for the authenticated API key (tier, calls, overage). * Requires an Attestd API key for vulnerability checks, CVE details, usage, and live product list; runs via stdio using npx -y @attestd/mcp.

Which integrations are available for this server?

Allows checking specific versions of NGINX for known CVEs and supply-chain risks. Allows checking JavaScript packages hosted on npm for vulnerabilities and supply-chain compromises. Allows checking specific versions of PostgreSQL for known CVEs and supply-chain risks. Allows checking Python packages hosted on PyPI for vulnerabilities and supply-chain compromises.

How do I use @attestd/mcp?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@attestd/mcp Check if lodash 4.17.21 has any critical vulnerabilities." That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

@attestd/mcp

Official

by attestd-io

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

@attestd/mcp

Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response.

Official Model Context Protocol (MCP) server for Attestd. Exposes CVE risk and supply-chain checks as tools for Claude Code, Claude Desktop, and any MCP-compatible client.

Get a free API key · Full docs

stdio transport: run via npx -y @attestd/mcp with no global install.
check_package_vulnerability: wraps GET /v1/check using @attestd/sdk.
check_batch_vulnerabilities: checks up to 100 packages in one call. Use for lockfile and manifest audits.
list_covered_products: returns Attestd-covered products. With an API key, returns live data from GET /v1/products. Without a key, returns the static bundled infrastructure list.
get_cve_details: returns CVSS, EPSS, KEV status, and affected products for a single CVE id.
get_usage: returns remaining quota for the authenticated key (GET /v1/usage).

Prerequisites

Node.js 18+
An Attestd API key from the portal. Required for check_package_vulnerability, check_batch_vulnerabilities, get_cve_details, get_usage, and live list_covered_products.

Related MCP server: kr.ai.vdb/vdb

Claude Code / MCP config

Add to ~/.claude/mcp.json or project .mcp.json:

{
  "mcpServers": {
    "attestd": {
      "command": "npx",
      "args": ["-y", "@attestd/mcp"],
      "env": {
        "ATTESTD_API_KEY": "your-api-key-here"
      }
    }
  }
}

Optional: override the API base URL (e.g. dev):

"env": {
  "ATTESTD_API_KEY": "your-api-key-here",
  "ATTESTD_BASE_URL": "https://dev.api.attestd.io"
}

Tools

`check_package_vulnerability`

Argument	Type	Description
`product`	string	Product slug (`nginx`, `postgresql`, `litellm`, …)
`version`	string	Exact version (`1.20.0`)

Returns JSON with:

Field	Meaning
`outsideCoverage`	`true` if the product is not covered. Unknown risk, not safe.
`riskState`	`critical` \| `high` \| `elevated` \| `low` \| `none` \| `null` when outside coverage
`riskFactors`	Risk factor vocabulary driving `riskState`
`maxEpss`	Highest EPSS probability across matching CVEs
`activelyExploited`	CISA KEV signal
`remoteExploitable`	`true` if any matching CVE is remotely exploitable
`authenticationRequired`	`true` only when all matching CVEs require authentication
`patchAvailable` / `fixedVersion`	Patch guidance
`confidence`	Synthesis confidence 0.0–1.0
`cveIds`	CVE IDs contributing to the risk assessment
`typosquat`	Package name integrity: `detected`, `resembles`, `confidence`, `ecosystem` (SDK 0.5 runtime; extra fields are omitted)
`message`	Explanation when `outsideCoverage` is true
`supplyChainCompromised` / `supplyChainDescription`	PyPI/npm supply-chain signal

On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

`check_batch_vulnerabilities`

Argument	Type	Description
`items`	array	Array of `{ product, version }` objects. Maximum 100 per call. Each item costs one API call.

Quota is checked upfront. If the batch would exceed your monthly quota, a 429 is returned before any calls are billed.

Returns JSON with count and results. Supported items include the same fields as check_package_vulnerability minus typosquat. Outside-coverage items return only product, version, outsideCoverage: true, and riskState: null.

`list_covered_products`

No arguments. With an API key, returns live JSON from GET /v1/products:

Field	Meaning
`source`	`"live"` when fetched from the API
`total`	Combined count of CVE products and supply chain packages
`cveProducts`	CVE infrastructure slugs with display names
`supplyChainPackages`	Monitored PyPI/npm packages

Without an API key, returns the static bundled list:

Field	Meaning
`source`	`"static"`
`count`	Number of bundled infrastructure products
`products`	Array of `{ slug, display }` entries

`get_cve_details`

Argument	Type	Description
`cve_id`	string	CVE identifier, e.g. `CVE-2021-44228`

Returns JSON with:

Field	Meaning
`found`	`true` when the CVE is in Attestd's database; `false` on 404 (not an error)
`cveId`	CVE identifier
`description`	NVD description text
`cvssScore` / `cvssVector`	CVSS base score and vector
`activelyExploited`	CISA KEV signal
`remoteExploitable`	Remotely exploitable
`authenticationRequired`	Authentication required for exploitation
`affectedProducts`	Attestd product slugs affected by this CVE
`epssScore` / `epssPercentile`	EPSS probability and percentile
`sourcePublishedAt` / `lastCheckedAt`	ISO timestamps

When the CVE is not found, returns { "found": false, "cveId": "..." } without isError. On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

`get_usage`

No arguments. Requires an API key. Returns JSON from GET /v1/usage:

Field	Meaning
`tier`	Account plan tier
`keyCallsThisMonth`	Calls billed to this key in the current period
`accountCallsThisMonth`	Calls billed across all keys on the account
`includedCalls`	Monthly included call cap
`billingPeriodStart` / `billingPeriodEnd`	ISO timestamps
`overageCalls` / `estimatedOverageUsd`	Overage vs the included cap

On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

Verify locally

npm run build
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | node dist/index.js

License

MIT. See LICENSE.

Available Tools

4 tools

check_batch_vulnerabilitiesA

Read-onlyIdempotent

Check up to 100 software packages or infrastructure products in a single request. Each item is billed as one API call. Use this instead of multiple check_package_vulnerability calls when you need to audit a lockfile, manifest, or dependency list. Items outside Attestd coverage return outsideCoverage=true and should be treated as unknown risk, not safe. A 429 is returned before any results are delivered if the batch would exceed your monthly quota; no calls are billed in that case.

Inputs: items (required). Returns: count, results

check_package_vulnerabilityA

Read-onlyIdempotent

Check whether a software package or infrastructure product version has known CVE vulnerabilities or a confirmed supply chain compromise. Call this before adding, updating, or recommending any npm, PyPI, or infrastructure dependency, including mid-conversation when a developer asks about installing or upgrading a package. outsideCoverage=true means Attestd has no data for that product; treat as unknown risk, not safe. Covers infrastructure products (nginx, PostgreSQL, Redis, Docker, Kubernetes, etc.) and PyPI/npm packages.

Inputs: product (required), version (required). Returns: error, cveIds, maxEpss, message, +12 more

get_cve_detailsA

Read-onlyIdempotent

Return full details for a single CVE id (CVSS, EPSS, KEV status, affected products). Use when you need context on a specific CVE before recommending a patch or explaining risk to a developer.

Inputs: cve_id (required). Returns: cveId, error, found, cvssScore, +10 more

list_covered_productsA

Read-onlyIdempotent

Returns Attestd-covered products for CVE checks. With an API key, returns live data from GET /v1/products (CVE infrastructure slugs plus monitored supply chain packages). Without a key, returns the static bundled infrastructure list. PyPI and npm packages also work with check_package_vulnerability even when absent from this list.

Inputs: no named parameters. Returns: count, total, source, products, +2 more

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

Claude Code, inside the Godot 4 editorFlockbay puts an AI agent in the real Godot 4 editor: it writes GDScript, runs your game and fixes what breaks. Free, or bring your own Claude Code or Codex.flockbay.comAd

TDQS

A4.6/5.0

Scored 2026-07-28 21:35 across 4 tools

Disambiguation5/5

Each tool targets a distinct operation: single package check, batch check, product listing, and CVE details. No overlap in functionality.

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern using snake_case, e.g., check_package_vulnerability, list_covered_products.

Tool Count5/5

Four tools cover the essential needs for vulnerability checking: individual, batch, reference data, and details. Well-scoped without redundancy.

Completeness4/5

Core workflows are covered (check, batch, list, details). Minor gap: no tool to manage coverage subscriptions or alerts, but not critical for the tool's purpose.

Maintenance

ActivitySlowing

ResponsivenessOutdated data

Resources

Related MCP Connectors

OSV Dependency Vulnerability Check
io.github.fairquery
Check npm, PyPI, Go and Maven packages or lockfiles against OSV.dev: CVEs, CVSS, fixed versions.
Security Penetration Testing Developer Tools
1
https://mcp.apify.com/?tools=fetch-actor-details,fairquery/osv-dependency-vulnerability-check
overflo.wsA
ws.overflo
Look up CVEs, CISA KEV, EPSS and open-source package vulnerabilities, including malicious packages.
Security Penetration Testing Open Data
71
https://mcp.overflo.ws/mcp
AgentDiet Real-Time Open-Source Package CVE & GHSA Vulnerability Scanner (OSV.dev)A
dev.agentdiet
Queries live Google OSV.dev vulnerability intelligence for any PyPI, npm, Go, or Rust crate and r.
Security Developer Tools
21
https://cve-intel.agentdiet.dev/mcp
VulnTrackerA
io.vulntracker
CVEs, affected versions and fix versions for your dependencies, from an affected-version ledger.
Security Penetration Testing Developer Tools
151
https://api.vulntracker.io/mcp

Related MCP Servers

Cybersecurity MCP Server
Security Penetration Testing
AiAgentKarl
A
license
Not graded
quality
D
maintenance
Enables searching the NIST NVD for CVEs, retrieving full CVE details, checking software for known vulnerabilities, and searching the CPE database.
Updated 7 months ago (2026-04-03 16:05 UTC)
22 PyPI
1
MIT
kr.ai.vdb/vdb
Security Penetration Testing Developer Tools
0pstech
A
license
A
quality
C
maintenance
MCP server for checking packages against an AI-aware vulnerability database, including CVEs, slopsquatting, CISA KEV, and MCP-server trust profiles.
Updated 20 days ago (2026-10-27 04:28 UTC)
10
43 PyPI
Elastic 2.0
nist-nvd-mcp-server
Security Government Data Research & Data
cyanheads
A
license
Not graded
quality
B
maintenance
Search and audit CVEs by keyword, severity, CWE, CISA KEV status, and CPE via the NIST National Vulnerability Database.
Updated 20 days ago (2026-10-26 07:22 UTC)
952 npm
2
Apache 2.0
Dependency Health MCP
Developer Tools Code Analysis
superbot-helper
A
license
Not graded
quality
C
maintenance
Enables checking whether software packages are deprecated, archived, stale, active, or unknown with supporting evidence, auditing dependency manifests, and looking up runtime support and end-of-life dates.
Updated 2 months ago (2026-09-03 00:48 UTC)
MIT

@attestd/mcp

Prerequisites

Claude Code / MCP config

Tools

check_package_vulnerability

check_batch_vulnerabilities

list_covered_products

get_cve_details

get_usage

Verify locally

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Cybersecurity MCP Server

kr.ai.vdb/vdb

nist-nvd-mcp-server

Dependency Health MCP

`check_package_vulnerability`

`check_batch_vulnerabilities`

`list_covered_products`

`get_cve_details`

`get_usage`