Skip to content

Releases: badchars/supply-chain-mcp-server

Release list

v0.2.0 — Composite Refactor

v0.2.0 — Composite Refactor Latest
Latest

Choose a tag to compare

View all tags
@badchars badchars released this 10 Jul 00:42
v0.2.0
23453c4

Composite Refactor — 90 Tools → 7 Composites (90 Techniques)

Major architecture update: 90 individual tools consolidated into 7 composite tools that orchestrate multiple techniques in parallel internally.

Composite Tools

Tool Techniques Description
vuln_scan 24 Vulnerability intelligence (OSV, GHSA, NVD, EPSS, KEV, Go Vuln)
package_info 33 Package metadata across 7 ecosystems (npm, PyPI, crates.io, Go, RubyGems, NuGet, Packagist)
dep_tree 14 Dependency graph via deps.dev + Libraries.io
security_check 7 Typosquatting, provenance, Sigstore Rekor
quality 8 OpenSSF Scorecard, Best Practices Badge, Repology
license 3 ClearlyDefined license compliance
meta 1 Data source listing

Key Changes

  • LLM context reduced from ~12K to ~1K tokens — AI agents load 7 tool definitions instead of 90
  • Each composite uses mode-based dispatch (e.g., vuln_scan has package, cve, batch, recent, go_module modes)
  • package_info auto-dispatches to the right registry based on ecosystem parameter
  • All techniques run in parallel within each composite
  • Backward compatible: --tool CLI accepts both composite and individual technique names
  • New CLI flag: --list-all shows all 90 individual techniques

Install

npx supply-chain-mcp-server

Full changelog: https://github.com/badchars/supply-chain-mcp-server/blob/main/CHANGELOG.md

Assets 2
Loading

v0.1.0 — Initial Release (90 Tools, 21 Sources)

v0.1.0 — Initial Release (90 Tools, 21 Sources)

Choose a tag to compare

View all tags
@badchars badchars released this 24 Jun 02:01
v0.1.0
eebe60c

supply-chain-mcp-server v0.1.0

Software supply chain security intelligence for AI agents — 90 tools across 21 data sources via the Model Context Protocol.

Highlights

  • 21 data sources unified into a single MCP server
  • 90 tools for vulnerability scanning, package analysis, provenance verification, license compliance, typosquatting detection
  • 7 package ecosystems: npm, PyPI, crates.io, RubyGems, NuGet, Packagist, Go
  • 3 vulnerability databases: OSV.dev, GitHub Advisory (GHSA), NIST NVD
  • Exploit intelligence: EPSS exploit prediction + CISA KEV active exploitation catalog
  • Provenance & trust: Sigstore Rekor, npm attestations, OpenSSF Scorecard, Best Practices Badge
  • License compliance: ClearlyDefined curated license data
  • Dependency intelligence: Google deps.dev, Libraries.io SourceRank
  • Cross-distro tracking: Repology package versions across distributions
  • Built-in typosquatting detection: Edit distance, confusable characters, similarity scoring

Quick Start

# No install needed
npx supply-chain-mcp-server

# Or install globally
npm i -g supply-chain-mcp-server

# Add to Claude Code
claude mcp add supply-chain -- npx supply-chain-mcp-server

Environment Variables (all optional)

Variable Purpose
GITHUB_TOKEN Higher rate limits for GHSA + Scorecard
LIBRARIES_API_KEY Required for Libraries.io tools
NVD_API_KEY 50 req/30s vs 5 req/30s

Most tools work without any API keys.

Links

Loading