English Français العربية

TridentChain Security

Registre officiel Outils de développement

Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload.

Code source Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

PYPI package tridentchain-mcp
Claude Code 
claude mcp add tridentchain-security -- uvx tridentchain-mcp==0.1.5
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "tridentchain-security": {
            "command": "uvx",
            "args": [
                "tridentchain-mcp==0.1.5"
            ]
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. TridentChain Security
  2. Install (plug and play)
  3. Use in your own Python app
  4. Scan profiles
  5. Desktop app (individual application)
  6. AI / automation (Claude, OpenAI, Cursor, VS Code, Windsurf, …)
  7. Development
  8. Optional API keys (power users)
  9. License

TridentChain Security

Local-first vulnerability scanner for project dependencies, developer tools, and IDE extensions.
Uses multi-source intelligence (OSV, NVD, GHSA, Sonatype) with KEV/EPSS prioritization.

No API key required for default usage.

Public repo: https://github.com/DevInder1/supply-chain-scanner-public

Install (plug and play)

pip3 install tridentchain-security
npm install -g @tridentchain/security-cli
tridentchain-security --help

Agents & MCP (Claude, Cursor, VS Code, Windsurf, Zed):

Pick whichever install path fits:

# Option A — pip (needs Python 3.10+)
pip3 install -U "tridentchain-security>=0.1.4" "tridentchain-mcp>=0.1.4"

# Option B — uvx (no manual Python install; uv handles it)
uvx tridentchain-mcp

# Option C — Docker (no Python needed, fully sandboxed)
docker pull ghcr.io/devinder1/tridentchain-mcp:latest
# Then in your MCP config, replace `python3 -m tridentchain_mcp` with:
#   command: docker
#   args: ["run", "--rm", "-i", "-v", "$PWD:/workspace", "ghcr.io/devinder1/tridentchain-mcp:latest"]

What you can do: docs/CAPABILITIES.md
Full guide: docs/INSTALL_AND_USE.md
Cross-platform (macOS / Linux / Windows): docs/CROSS_PLATFORM.md
(PyPI: tridentchain-security · npm: @tridentchain/security-cli)

tridentchain-security --scan all --project-path . --output-dir scanner-output

Use in your own Python app

from scanner import run_scan

summary = run_scan(
    project_path=".",
    scan="all",
    run_profile="full",  # no API key required
    output_dir="scanner-output",
)
print(summary["summary"])

Scan profiles

ProfileDescription
full (default)Project + system + extensions. OSV + NVD without keys.
quickFaster project-focused scan.
offlineLocal advisory DB only, no network.
Power-userAdd GITHUB_TOKEN, NVD_API_KEY, optional SONATYPE_TOKEN for best coverage.

Desktop app (individual application)

No repo clone required if the pip package is installed:

pip3 install tridentchain-security
cd apps/desktop && npm install && npm run start

See apps/desktop/README.md and docs/DISTRIBUTION_VERIFICATION.md.

AI / automation (Claude, OpenAI, Cursor, VS Code, Windsurf, …)

One install, every agent: pip install "tridentchain-security>=0.1.2" tridentchain-mcp

GuideDescription
Agent integrationsClaude · OpenAI · Cursor · VS Code · Windsurf · Zed · MCP · CLI
CapabilitiesEverything you can do today
ArchitectureMCP + unified tools design
./scripts/setup-agent-mcp.sh cursor   # prints setup for your agent

Phase 2 — Claude MCP: pip install tridentchain-mcp · Setup guide · Plugin

Phase 3 — OpenAI + Cursor: examples/openai/ · Cursor setup · .cursor/mcp.json.example

Phase 4 — VS Code (Anthropic MCP): Open repo → MCP ready · VS Code setup · ./scripts/vscode-mcp-install-link.sh · extension

Phase 5 — Validate: tridentchain-security --validate · MCP validate_after_patch · CAPABILITIES.md

Unified tool layer: from scanner.integrations import execute_tool, get_tool_definitions, to_openai_tools

Development

git clone https://github.com/DevInder1/supply-chain-scanner-public.git
cd supply-chain-scanner-public
python3 -m pip install -e .
tridentchain-security --help
python3 -m unittest scanner.tests.test_matcher_ranges -v

Install & use: docs/INSTALL_AND_USE.md
Cross-platform: docs/CROSS_PLATFORM.md
CLI contract: docs/cli-contract.md
Publishing: docs/PUBLISHING.md

Optional API keys (power users)

VariablePurpose
NVD_API_KEYHigher NVD rate limits
GITHUB_TOKENGHSA advisories
SONATYPE_TOKENSonatype Guide advisories

Set in .env or environment variables.

License

MIT — see LICENSE

Questions fréquentes

Qu'est-ce que TridentChain Security ?

Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload.

Comment installer TridentChain Security ?

Il s'exécute sur votre machine. Dans Claude Code : claude mcp add tridentchain-security -- uvx tridentchain-mcp==0.1.5. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour TridentChain Security ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

TridentChain Security est-il open source ?

Oui. Son code est sur GitHub sous licence MIT.

Qui maintient TridentChain Security ?

Il est publié par DevInder1. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.