English Français العربية

TridentChain Security

Official registry Developer tools

Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload.

Source code Documentation

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

PYPI package tridentchain-mcp
Claude Code 
claude mcp add tridentchain-security -- uvx tridentchain-mcp==0.1.5
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "tridentchain-security": {
            "command": "uvx",
            "args": [
                "tridentchain-mcp==0.1.5"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. TridentChain Security
  2. Install (plug and play)
  3. Use in your own Python app
  4. Scan profiles
  5. Desktop app (individual application)
  6. AI / automation (Claude, OpenAI, Cursor, VS Code, Windsurf, …)
  7. Development
  8. Optional API keys (power users)
  9. License

TridentChain Security

Local-first vulnerability scanner for project dependencies, developer tools, and IDE extensions.
Uses multi-source intelligence (OSV, NVD, GHSA, Sonatype) with KEV/EPSS prioritization.

No API key required for default usage.

Public repo: https://github.com/DevInder1/supply-chain-scanner-public

Install (plug and play)

pip3 install tridentchain-security
npm install -g @tridentchain/security-cli
tridentchain-security --help

Agents & MCP (Claude, Cursor, VS Code, Windsurf, Zed):

Pick whichever install path fits:

# Option A — pip (needs Python 3.10+)
pip3 install -U "tridentchain-security>=0.1.4" "tridentchain-mcp>=0.1.4"

# Option B — uvx (no manual Python install; uv handles it)
uvx tridentchain-mcp

# Option C — Docker (no Python needed, fully sandboxed)
docker pull ghcr.io/devinder1/tridentchain-mcp:latest
# Then in your MCP config, replace `python3 -m tridentchain_mcp` with:
#   command: docker
#   args: ["run", "--rm", "-i", "-v", "$PWD:/workspace", "ghcr.io/devinder1/tridentchain-mcp:latest"]

What you can do: docs/CAPABILITIES.md
Full guide: docs/INSTALL_AND_USE.md
Cross-platform (macOS / Linux / Windows): docs/CROSS_PLATFORM.md
(PyPI: tridentchain-security · npm: @tridentchain/security-cli)

tridentchain-security --scan all --project-path . --output-dir scanner-output

Use in your own Python app

from scanner import run_scan

summary = run_scan(
    project_path=".",
    scan="all",
    run_profile="full",  # no API key required
    output_dir="scanner-output",
)
print(summary["summary"])

Scan profiles

ProfileDescription
full (default)Project + system + extensions. OSV + NVD without keys.
quickFaster project-focused scan.
offlineLocal advisory DB only, no network.
Power-userAdd GITHUB_TOKEN, NVD_API_KEY, optional SONATYPE_TOKEN for best coverage.

Desktop app (individual application)

No repo clone required if the pip package is installed:

pip3 install tridentchain-security
cd apps/desktop && npm install && npm run start

See apps/desktop/README.md and docs/DISTRIBUTION_VERIFICATION.md.

AI / automation (Claude, OpenAI, Cursor, VS Code, Windsurf, …)

One install, every agent: pip install "tridentchain-security>=0.1.2" tridentchain-mcp

GuideDescription
Agent integrationsClaude · OpenAI · Cursor · VS Code · Windsurf · Zed · MCP · CLI
CapabilitiesEverything you can do today
ArchitectureMCP + unified tools design
./scripts/setup-agent-mcp.sh cursor   # prints setup for your agent

Phase 2 — Claude MCP: pip install tridentchain-mcp · Setup guide · Plugin

Phase 3 — OpenAI + Cursor: examples/openai/ · Cursor setup · .cursor/mcp.json.example

Phase 4 — VS Code (Anthropic MCP): Open repo → MCP ready · VS Code setup · ./scripts/vscode-mcp-install-link.sh · extension

Phase 5 — Validate: tridentchain-security --validate · MCP validate_after_patch · CAPABILITIES.md

Unified tool layer: from scanner.integrations import execute_tool, get_tool_definitions, to_openai_tools

Development

git clone https://github.com/DevInder1/supply-chain-scanner-public.git
cd supply-chain-scanner-public
python3 -m pip install -e .
tridentchain-security --help
python3 -m unittest scanner.tests.test_matcher_ranges -v

Install & use: docs/INSTALL_AND_USE.md
Cross-platform: docs/CROSS_PLATFORM.md
CLI contract: docs/cli-contract.md
Publishing: docs/PUBLISHING.md

Optional API keys (power users)

VariablePurpose
NVD_API_KEYHigher NVD rate limits
GITHUB_TOKENGHSA advisories
SONATYPE_TOKENSonatype Guide advisories

Set in .env or environment variables.

License

MIT — see LICENSE

Frequently asked questions

What is TridentChain Security?

Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload.

How do I install TridentChain Security?

It runs on your machine. In Claude Code: claude mcp add tridentchain-security -- uvx tridentchain-mcp==0.1.5. For other clients, paste the JSON configuration from this page into their MCP settings.

Does TridentChain Security need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is TridentChain Security open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains TridentChain Security?

It is published by DevInder1. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.