{
  "markdown": "# @attestd/mcp\n\n[![npm version](https://img.shields.io/npm/v/@attestd/mcp)](https://www.npmjs.com/package/@attestd/mcp)\n[![smithery badge](https://smithery.ai/badge/@attestd/mcp)](https://smithery.ai/server/@attestd/mcp)\n\n> Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response.\n\nOfficial [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server for [Attestd](https://attestd.io). Exposes CVE risk and supply-chain checks as tools for Claude Code, Claude Desktop, and any MCP-compatible client.\n\n[Get a free API key](https://api.attestd.io/portal/login) · [Full docs](https://attestd.io/docs/integrations/mcp)\n\n- **stdio transport**: run via `npx -y @attestd/mcp` with no global install.\n- **`check_package_vulnerability`**: wraps [`GET /v1/check`](https://attestd.io/docs/api-reference) using [`@attestd/sdk`](https://www.npmjs.com/package/@attestd/sdk).\n- **`check_batch_vulnerabilities`**: checks up to 100 packages in one call. Use for lockfile and manifest audits.\n- **`list_covered_products`**: returns Attestd-covered products. With an API key, returns live data from `GET /v1/products`. Without a key, returns the static bundled infrastructure list.\n- **`get_cve_details`**: returns CVSS, EPSS, KEV status, and affected products for a single CVE id.\n\n## Prerequisites\n\n- Node.js 18+\n- An Attestd API key from the [portal](https://api.attestd.io/portal/login). Required for `check_package_vulnerability`, `check_batch_vulnerabilities`, `get_cve_details`, and live `list_covered_products`.\n\n## Claude Code / MCP config\n\nAdd to `~/.claude/mcp.json` or project `.mcp.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"attestd\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@attestd/mcp\"],\n      \"env\": {\n        \"ATTESTD_API_KEY\": \"your-api-key-here\"\n      }\n    }\n  }\n}\n```\n\nOptional: override the API base URL (e.g. dev):\n\n```json\n\"env\": {\n  \"ATTESTD_API_KEY\": \"your-api-key-here\",\n  \"ATTESTD_BASE_URL\": \"https://dev.api.attestd.io\"\n}\n```\n\n## Tools\n\n### `check_package_vulnerability`\n\n| Argument  | Type   | Description |\n| --------- | ------ | ----------- |\n| `product` | string | Product slug (`nginx`, `postgresql`, `litellm`, …) |\n| `version` | string | Exact version (`1.20.0`) |\n\nReturns JSON with:\n\n| Field | Meaning |\n| ----- | ------- |\n| `outsideCoverage` | `true` if the product is not covered. Unknown risk, not safe. |\n| `riskState` | `critical` \\| `high` \\| `elevated` \\| `low` \\| `none` \\| `null` when outside coverage |\n| `activelyExploited` | CISA KEV signal |\n| `remoteExploitable` | `true` if any matching CVE is remotely exploitable |\n| `authenticationRequired` | `true` only when all matching CVEs require authentication |\n| `patchAvailable` / `fixedVersion` | Patch guidance |\n| `confidence` | Synthesis confidence 0.0–1.0 |\n| `cveIds` | CVE IDs contributing to the risk assessment |\n| `typosquat` | Package name integrity: typosquat or AI-hallucinated name (`kind`, `resembles`, `likely_intended`) |\n| `message` | Explanation when `outsideCoverage` is true |\n| `supplyChainCompromised` / `supplyChainDescription` | PyPI/npm supply-chain signal |\n\nOn invalid/missing API key or rate limit, returns `isError: true` with a JSON `error` string.\n\n### `check_batch_vulnerabilities`\n\n| Argument | Type  | Description |\n| -------- | ----- | ----------- |\n| `items`  | array | Array of `{ product, version }` objects. Maximum 100 per call. Each item costs one API call. |\n\nQuota is checked upfront. If the batch would exceed your monthly quota, a 429 is returned before any calls are billed.\n\nReturns JSON with `count` and `results`. Supported items include the same fields as `check_package_vulnerability` minus `typosquat`. Outside-coverage items return only `product`, `version`, `outsideCoverage: true`, and `riskState: null`.\n\n### `list_covered_products`\n\nNo arguments. With an API key, returns live JSON from `GET /v1/products`:\n\n| Field | Meaning |\n| ----- | ------- |\n| `source` | `\"live\"` when fetched from the API |\n| `total` | Combined count of CVE products and supply chain packages |\n| `cveProducts` | CVE infrastructure slugs with display names |\n| `supplyChainPackages` | Monitored PyPI/npm packages |\n\nWithout an API key, returns the static bundled list:\n\n| Field | Meaning |\n| ----- | ------- |\n| `source` | `\"static\"` |\n| `count` | Number of bundled infrastructure products |\n| `products` | Array of `{ slug, display }` entries |\n\n### `get_cve_details`\n\n| Argument | Type   | Description |\n| -------- | ------ | ----------- |\n| `cve_id` | string | CVE identifier, e.g. `CVE-2021-44228` |\n\nReturns JSON with:\n\n| Field | Meaning |\n| ----- | ------- |\n| `found` | `true` when the CVE is in Attestd's database; `false` on 404 (not an error) |\n| `cveId` | CVE identifier |\n| `description` | NVD description text |\n| `cvssScore` / `cvssVector` | CVSS base score and vector |\n| `activelyExploited` | CISA KEV signal |\n| `remoteExploitable` | Remotely exploitable |\n| `authenticationRequired` | Authentication required for exploitation |\n| `affectedProducts` | Attestd product slugs affected by this CVE |\n| `epssScore` / `epssPercentile` | EPSS probability and percentile |\n| `sourcePublishedAt` / `lastCheckedAt` | ISO timestamps |\n\nWhen the CVE is not found, returns `{ \"found\": false, \"cveId\": \"...\" }` without `isError`. On invalid/missing API key or rate limit, returns `isError: true` with a JSON `error` string.\n\n## Verify locally\n\n```bash\nnpm run build\necho '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}' | node dist/index.js\n```\n\n## License\n\nMIT. See [LICENSE](./LICENSE).\n",
  "bytes": 5633,
  "sha": "26a4289e4b9fbaba9924e5bcd8b97be159b9af1f3404f61f3fcc32f75e6c0a78",
  "repo_slug": "attestd-io/attestd-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_attestd_io_attestd_mcp_5b5a9665/readme"
}