v0.1.0 — Initial Release (90 Tools, 21 Sources)

supply-chain-mcp-server v0.1.0

Software supply chain security intelligence for AI agents — 90 tools across 21 data sources via the Model Context Protocol.

Highlights

• 21 data sources unified into a single MCP server
• 90 tools for vulnerability scanning, package analysis, provenance verification, license compliance, typosquatting detection
• 7 package ecosystems: npm, PyPI, crates.io, RubyGems, NuGet, Packagist, Go
• 3 vulnerability databases: OSV.dev, GitHub Advisory (GHSA), NIST NVD
• Exploit intelligence: EPSS exploit prediction + CISA KEV active exploitation catalog
• Provenance & trust: Sigstore Rekor, npm attestations, OpenSSF Scorecard, Best Practices Badge
• License compliance: ClearlyDefined curated license data
• Dependency intelligence: Google deps.dev, Libraries.io SourceRank
• Cross-distro tracking: Repology package versions across distributions
• Built-in typosquatting detection: Edit distance, confusable characters, similarity scoring

Quick Start

# No install needed
npx supply-chain-mcp-server

# Or install globally
npm i -g supply-chain-mcp-server

# Add to Claude Code
claude mcp add supply-chain -- npx supply-chain-mcp-server

Environment Variables (all optional)

Variable	Purpose
GITHUB_TOKEN	Higher rate limits for GHSA + Scorecard
LIBRARIES_API_KEY	Required for Libraries.io tools
NVD_API_KEY	50 req/30s vs 5 req/30s

Most tools work without any API keys.

Links

• npm: https://www.npmjs.com/package/supply-chain-mcp-server
• Docs: https://github.com/badchars/supply-chain-mcp-server#readme