Composite Refactor — 90 Tools → 7 Composites (90 Techniques)
Major architecture update: 90 individual tools consolidated into 7 composite tools that orchestrate multiple techniques in parallel internally.
Composite Tools
| Tool | Techniques | Description |
|---|---|---|
vuln_scan |
24 | Vulnerability intelligence (OSV, GHSA, NVD, EPSS, KEV, Go Vuln) |
package_info |
33 | Package metadata across 7 ecosystems (npm, PyPI, crates.io, Go, RubyGems, NuGet, Packagist) |
dep_tree |
14 | Dependency graph via deps.dev + Libraries.io |
security_check |
7 | Typosquatting, provenance, Sigstore Rekor |
quality |
8 | OpenSSF Scorecard, Best Practices Badge, Repology |
license |
3 | ClearlyDefined license compliance |
meta |
1 | Data source listing |
Key Changes
- LLM context reduced from ~12K to ~1K tokens — AI agents load 7 tool definitions instead of 90
- Each composite uses mode-based dispatch (e.g.,
vuln_scanhaspackage,cve,batch,recent,go_modulemodes) package_infoauto-dispatches to the right registry based on ecosystem parameter- All techniques run in parallel within each composite
- Backward compatible:
--toolCLI accepts both composite and individual technique names - New CLI flag:
--list-allshows all 90 individual techniques
Install
npx supply-chain-mcp-serverFull changelog: https://github.com/badchars/supply-chain-mcp-server/blob/main/CHANGELOG.md