io.github.attestd-io/attestd-mcp

Official registry Other

CVE checks, supply chain signals, live catalog, and CVE detail for MCP clients (infra, PyPI, npm).

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package @attestd/mcp

Claude Code

claude mcp add attestd-mcp -e 'ATTESTD_API_KEY=<your attestd_api_key>' -e 'ATTESTD_BASE_URL=<ATTESTD_BASE_URL>' -- npx -y @attestd/mcp@0.3.1

JSON configuration (Claude Desktop, Cursor, VS Code)

{
    "mcpServers": {
        "attestd-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "@attestd/mcp@0.3.1"
            ],
            "env": {
                "ATTESTD_API_KEY": "<your attestd_api_key>",
                "ATTESTD_BASE_URL": "<ATTESTD_BASE_URL>"
            }
        }
    }
}

Environment variables

ATTESTD_API_KEY secret Attestd API key (atst_...). Required for check_package_vulnerability, check_batch_vulnerabilities, get_cve_details, and live list_covered_products. Get one at https://api.attestd.io/portal
ATTESTD_BASE_URL Optional API base URL override. Defaults to https://api.attestd.io

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents

@attestd/mcp
Prerequisites
Claude Code / MCP config
Tools
Verify locally
License

@attestd/mcp

Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response.

Official Model Context Protocol (MCP) server for Attestd. Exposes CVE risk and supply-chain checks as tools for Claude Code, Claude Desktop, and any MCP-compatible client.

Get a free API key · Full docs

stdio transport: run via npx -y @attestd/mcp with no global install.
check_package_vulnerability: wraps GET /v1/check using @attestd/sdk.
check_batch_vulnerabilities: checks up to 100 packages in one call. Use for lockfile and manifest audits.
list_covered_products: returns Attestd-covered products. With an API key, returns live data from GET /v1/products. Without a key, returns the static bundled infrastructure list.
get_cve_details: returns CVSS, EPSS, KEV status, and affected products for a single CVE id.
get_usage: returns remaining quota for the authenticated key (GET /v1/usage).

Prerequisites

Node.js 18+
An Attestd API key from the portal. Required for check_package_vulnerability, check_batch_vulnerabilities, get_cve_details, get_usage, and live list_covered_products.

Claude Code / MCP config

Add to ~/.claude/mcp.json or project .mcp.json:

{
  "mcpServers": {
    "attestd": {
      "command": "npx",
      "args": ["-y", "@attestd/mcp"],
      "env": {
        "ATTESTD_API_KEY": "your-api-key-here"
      }
    }
  }
}

Optional: override the API base URL (e.g. dev):

"env": {
  "ATTESTD_API_KEY": "your-api-key-here",
  "ATTESTD_BASE_URL": "https://dev.api.attestd.io"
}

Tools

`check_package_vulnerability`

Argument	Type	Description
`product`	string	Product slug (`nginx`, `postgresql`, `litellm`, …)
`version`	string	Exact version (`1.20.0`)

Returns JSON with:

Field	Meaning
`outsideCoverage`	`true` if the product is not covered. Unknown risk, not safe.
`riskState`	`critical` \	`high` \	`elevated` \	`low` \	`none` \	`null` when outside coverage
`riskFactors`	Risk factor vocabulary driving `riskState`
`maxEpss`	Highest EPSS probability across matching CVEs
`activelyExploited`	CISA KEV signal
`remoteExploitable`	`true` if any matching CVE is remotely exploitable
`authenticationRequired`	`true` only when all matching CVEs require authentication
`patchAvailable` / `fixedVersion`	Patch guidance
`confidence`	Synthesis confidence 0.0–1.0
`cveIds`	CVE IDs contributing to the risk assessment
`typosquat`	Package name integrity: `detected`, `resembles`, `confidence`, `ecosystem` (SDK 0.5 runtime; extra fields are omitted)
`message`	Explanation when `outsideCoverage` is true
`supplyChainCompromised` / `supplyChainDescription`	PyPI/npm supply-chain signal

On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

`check_batch_vulnerabilities`

Argument	Type	Description
`items`	array	Array of `{ product, version }` objects. Maximum 100 per call. Each item costs one API call.

Quota is checked upfront. If the batch would exceed your monthly quota, a 429 is returned before any calls are billed.

Returns JSON with count and results. Supported items include the same fields as check_package_vulnerability minus typosquat. Outside-coverage items return only product, version, outsideCoverage: true, and riskState: null.

`list_covered_products`

No arguments. With an API key, returns live JSON from GET /v1/products:

Field	Meaning
`source`	`"live"` when fetched from the API
`total`	Combined count of CVE products and supply chain packages
`cveProducts`	CVE infrastructure slugs with display names
`supplyChainPackages`	Monitored PyPI/npm packages

Without an API key, returns the static bundled list:

Field	Meaning
`source`	`"static"`
`count`	Number of bundled infrastructure products
`products`	Array of `{ slug, display }` entries

`get_cve_details`

Argument	Type	Description
`cve_id`	string	CVE identifier, e.g. `CVE-2021-44228`

Returns JSON with:

Field	Meaning
`found`	`true` when the CVE is in Attestd's database; `false` on 404 (not an error)
`cveId`	CVE identifier
`description`	NVD description text
`cvssScore` / `cvssVector`	CVSS base score and vector
`activelyExploited`	CISA KEV signal
`remoteExploitable`	Remotely exploitable
`authenticationRequired`	Authentication required for exploitation
`affectedProducts`	Attestd product slugs affected by this CVE
`epssScore` / `epssPercentile`	EPSS probability and percentile
`sourcePublishedAt` / `lastCheckedAt`	ISO timestamps

When the CVE is not found, returns { "found": false, "cveId": "..." } without isError. On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

`get_usage`

No arguments. Requires an API key. Returns JSON from GET /v1/usage:

Field	Meaning
`tier`	Account plan tier
`keyCallsThisMonth`	Calls billed to this key in the current period
`accountCallsThisMonth`	Calls billed across all keys on the account
`includedCalls`	Monthly included call cap
`billingPeriodStart` / `billingPeriodEnd`	ISO timestamps
`overageCalls` / `estimatedOverageUsd`	Overage vs the included cap

On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

Verify locally

npm run build
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | node dist/index.js

License

MIT. See LICENSE.

Frequently asked questions

What is io.github.attestd-io/attestd-mcp?

CVE checks, supply chain signals, live catalog, and CVE detail for MCP clients (infra, PyPI, npm).

How do I install io.github.attestd-io/attestd-mcp?

It runs on your machine. In Claude Code: claude mcp add attestd-mcp -e 'ATTESTD_API_KEY=<your attestd_api_key>' -e 'ATTESTD_BASE_URL=<ATTESTD_BASE_URL>' -- npx -y @attestd/mcp@0.3.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.attestd-io/attestd-mcp need an API key?

Yes. It expects ATTESTD_API_KEY, which you set in its configuration.

Is io.github.attestd-io/attestd-mcp open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.attestd-io/attestd-mcp?

It is published by attestd-io. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.

Server details

Listed in: Official MCP Registry
Publisher: attestd-io
Category: Other
Runs: Local
GitHub stars: ★ 0
License: MIT
Language: TypeScript
Last commit: Oct 8, 2026
Open issues: 0
Version: 0.3.1
Published: Sep 26, 2026

io.github.attestd-io/attestd-mcp

Similar servers

link-check-lite Check web links for status codes, broken links and redirect chains.
Nodle IoT Dashboard Fleets, devices, detections and webhooks on the Nodle Bluetooth Low Energy network.
Attest Find your Attest studies and read their survey results, boards and key findings.
CursiveLines Learn cursive and print letters, practice, print practice sheets and write your name as...
overpass.ch Overpass API on the full planet with history, plus geocoding and elevation. Needs an AP...
CTAS Work Attendance, shifts, leave, payroll and team tools for CTAS Work organizations.
Rebond, offres d'emploi Offres d'emploi publiques en France : recherche par métier, ville, contrat, télétravail.
KG-SSOT Company-brain knowledge graphs: confirmed claims cite sources, and decisions get revisited

Other