# Supply Chain Mcp Server > 90-tool MCP server for software supply chain security — OSV, GHSA, NVD, EPSS, CISA KEV, npm, PyPI, crates.io, RubyGems, NuGet, Packagist, Go, deps.dev, Scorecard, Rekor, ClearlyDefined, Repology, typosquatting detection - **Type:** MCP server - **Install:** `agentstack add mcp-badchars-supply-chain-mcp-server` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [badchars](https://agentstack.voostack.com/s/badchars) - **Installs:** 0 - **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [badchars](https://github.com/badchars) - **Source:** https://github.com/badchars/supply-chain-mcp-server - **Website:** https://www.npmjs.com/package/supply-chain-mcp-server ## Install ```sh agentstack add mcp-badchars-supply-chain-mcp-server ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português (Brasil) | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी Supply chain security intelligence for AI agents. OSV, GHSA, NVD, EPSS, CISA KEV, npm, PyPI, crates.io, RubyGems, NuGet, Packagist, Go, deps.dev, Scorecard, Libraries.io, ClearlyDefined, Rekor, Repology, typosquatting detection — unified into a single MCP server. Your AI agent gets full-spectrum supply chain intelligence on demand, not 21 browser tabs and manual correlation. The Problem • How It's Different • Quick Start • What The AI Can Do • Tools (7 + 90) • Data Sources • Architecture • Changelog • Contributing --- ## The Problem Supply chain security intelligence is the missing layer in modern software development. Vulnerability databases, package registries, provenance verification, exploit prediction scoring, license compliance, security scorecards, typosquatting detection — the data you need is scattered across dozens of platforms, each with its own API, its own auth, its own rate limits, its own output format. Today you check OSV in one tab, NVD in another, pull up npm advisories, check EPSS scores on FIRST.org, verify Sigstore provenance in yet another tab, look up OpenSSF Scorecard, cross-reference CISA KEV, and then spend an hour manually piecing it all together. ``` Traditional supply chain security workflow: check vulnerabilities -> OSV + NVD + GitHub Advisories (3 separate UIs) assess exploit likelihood -> EPSS scores (separate API) check active exploitation -> CISA KEV catalog (separate JSON feed) verify package provenance -> Sigstore/Rekor + npm attestations (multiple CLIs) check security practices -> OpenSSF Scorecard + Best Practices Badge (2 UIs) audit dependencies -> deps.dev + Libraries.io (2 more UIs) check registry metadata -> npm + PyPI + crates.io + Go (4 registries) check for typosquatting -> manual name comparison (error-prone) verify license compliance -> ClearlyDefined (another UI) check distro packaging -> Repology (yet another UI) ──────────────────────────────── Total: 45+ minutes per package audit, most of it switching contexts ``` **supply-chain-mcp-server** gives your AI agent 7 composite tools (orchestrating 90 techniques internally) across 21 data sources via the [Model Context Protocol](https://modelcontextprotocol.io). The agent calls a single tool like `vuln_scan` or `package_info`, which automatically fans out to the right techniques in parallel, correlates vulnerability data with exploit predictions, verifies provenance, checks security posture, and presents a unified supply chain risk assessment — in a single conversation. ``` With supply-chain-mcp-server: You: "Audit the security posture of the express npm package" Agent: -> vuln_scan(mode:"package", ecosystem:"npm", name:"express") internally runs: osv_query + ghsa_package + epss_batch + kev_lookup -> package_info(ecosystem:"npm", name:"express", version:"4.21.2") internally runs: npm_package + npm_downloads + npm_maintainers + npm_scripts + npm_provenance -> quality(mode:"scorecard", owner:"expressjs", repo:"express") internally runs: scorecard_repo -> "express has a strong security posture. 2 known vulns but neither actively exploited (not in KEV). High EPSS on one CVE warrants patching priority. Provenance verified via Sigstore. OpenSSF Scorecard 8.2/10." ``` --- ## How It's Different Existing tools give you raw data one source at a time. supply-chain-mcp-server gives your AI agent the ability to **reason across vulnerability, provenance, and package intelligence simultaneously**. Traditional Approach supply-chain-mcp-server Interface 21 different web UIs, CLIs, and APIs MCP — AI agent calls tools conversationally Vulnerability data Check OSV, NVD, GHSA separately Agent queries all 3 + EPSS + KEV in parallel Package registries npm, PyPI, crates.io, Go, RubyGems, NuGet, Packagist separately 7 ecosystems in one server — agent picks the right one Provenance Manual Sigstore/Rekor verification, npm attestation checks Agent checks npm provenance + Rekor log + attestation bundles License compliance Manual ClearlyDefined lookups, one package at a time Agent resolves licenses across ecosystems with batch support Security posture OpenSSF Scorecard + Best Practices Badge separately Agent combines Scorecard + Badge + deps.dev + Libraries.io SourceRank Typosquatting Manual name comparison, easy to miss Built-in Levenshtein + confusable character detection API keys Required for most platforms 18 of 21 sources work free — API keys unlock higher rate limits Setup Install multiple tools, manage each config npx supply-chain-mcp-server — one command, zero config --- ## Quick Start ### Option 1: npx (no install) ```bash npx supply-chain-mcp-server ``` 7 composite tools (90 techniques) work immediately. No API keys required for most data sources — 18 of 21 sources are fully free. ### Option 2: Clone ```bash git clone https://github.com/badchars/supply-chain-mcp-server.git cd supply-chain-mcp-server bun install ``` ### Environment variables (optional) ```bash export GITHUB_TOKEN=your-token # GHSA + Scorecard higher rate limits export LIBRARIES_API_KEY=your-key # Required for Libraries.io tools export NVD_API_KEY=your-key # 50 req/30s vs 5 req/30s without key ``` All API keys are optional. Without them, you still get 6 of 7 composite tools fully operational — only Libraries.io (within `dep_tree`) requires an API key. ### Connect to your AI agent Claude Code ```bash # With npx claude mcp add supply-chain-mcp-server -- npx supply-chain-mcp-server # With local clone claude mcp add supply-chain-mcp-server -- bun run /path/to/supply-chain-mcp-server/src/index.ts ``` Claude Desktop Add to `~/Library/Application Support/Claude/claude_desktop_config.json`: ```json { "mcpServers": { "supply-chain": { "command": "npx", "args": ["-y", "supply-chain-mcp-server"], "env": { "GITHUB_TOKEN": "optional", "LIBRARIES_API_KEY": "optional", "NVD_API_KEY": "optional" } } } } ``` Cursor / Windsurf / other MCP clients Same JSON config format. Point the command to `npx supply-chain-mcp-server` or your local installation path. ### Start querying ``` You: "Check if express@4.17.1 has any known vulnerabilities and verify its provenance" ``` That's it. The agent handles vulnerability lookups, EPSS scoring, KEV checks, provenance verification, and more automatically. --- ## What The AI Can Do ### Full Package Audit ``` You: "Do a complete security audit of the lodash npm package" Agent: -> vuln_scan {mode: "package", ecosystem: "npm", name: "lodash"} ↳ osv_query + ghsa_package + epss_batch + kev_lookup (parallel) -> package_info {ecosystem: "npm", name: "lodash", version: "4.17.21"} ↳ npm_package + npm_downloads + npm_maintainers + npm_scripts + npm_provenance + npm_attestations + npm_audit_bulk (parallel) -> quality {mode: "scorecard", owner: "lodash", repo: "lodash"} ↳ scorecard_repo -> license {mode: "lookup", type: "npm", name: "lodash", version: "4.17.21"} ↳ license_lookup -> "lodash@4.17.21 security audit: Vulnerabilities: 3 historical (all fixed in 4.17.21), including prototype pollution CVE-2020-8203. Provenance: No Sigstore attestation (published pre-provenance era). OpenSSF Scorecard: 6.1/10 — no branch protection, no fuzzing. Dependencies: Zero runtime deps (self-contained). License: MIT (ClearlyDefined confirmed). Lifecycle scripts: None — clean. Recommendation: Safe to use at latest version. Consider migrating to lodash-es for tree-shaking." ``` ### Vulnerability Triage ``` You: "Triage CVE-2024-3094 — how urgent is this?" Agent: -> vuln_scan {mode: "cve", cve_id: "CVE-2024-3094"} ↳ nvd_cve + osv_id + ghsa_id + epss_score + kev_lookup (parallel) -> "CVE-2024-3094 (xz-utils backdoor): CVSS: 10.0 Critical — backdoor in xz-utils 5.6.0/5.6.1 EPSS: 0.95 (99th percentile) — extremely likely to be exploited CISA KEV: YES — actively exploited, deadline March 2024 Affects: xz-utils/liblzma on Linux (sshd via systemd) This is CRITICAL. Immediate action required: 1. Downgrade xz-utils to 5.4.x or remove 5.6.0/5.6.1 2. Check all systems for affected versions 3. This was a sophisticated supply chain attack via a compromised maintainer." ``` ### Dependency Risk Assessment ``` You: "Assess the supply chain risk of adding fastapi to our Python project" Agent: -> package_info {ecosystem: "pypi", name: "fastapi"} ↳ pypi_package + pypi_releases + pypi_maintainers (parallel) -> vuln_scan {mode: "package", ecosystem: "PyPI", name: "fastapi"} ↳ osv_query + ghsa_package + epss + kev (parallel) -> dep_tree {mode: "dependencies", ecosystem: "pypi", name: "fastapi", version: "0.115.0"} ↳ deps_dependencies + deps_requirements + libraries_deps (parallel) -> quality {mode: "full", owner: "tiangolo", repo: "fastapi", repo_url: "https://github.com/tiangolo/fastapi"} ↳ scorecard_repo + badge_by_repo (parallel) -> security_check {mode: "typosquat", name: "fastapi", ecosystem: "pypi"} ↳ typosquat_check -> "fastapi supply chain risk assessment: Vulnerabilities: 1 low-severity (fixed in latest). Dependencies: 5 direct (starlette, pydantic, etc.), 23 transitive. OpenSSF Scorecard: 7.4/10 — good CI/CD, signed releases. Maintainer: single primary maintainer (tiangolo). Typosquatting: 'fast-api' and 'fastapi2' exist — verify you're installing the correct package. Risk: LOW. Well-maintained, active community, good security practices. Single-maintainer risk is mitigated by strong automation and community oversight." ``` ### Typosquatting Detection ``` You: "I'm about to install 'reqeusts' from PyPI — is this safe?" Agent: -> security_check {mode: "typosquat", name: "reqeusts", ecosystem: "pypi"} ↳ typosquat_check -> security_check {mode: "compare_names", name_a: "reqeusts", name_b: "requests"} ↳ typosquat_compare -> "WARNING: 'reqeusts' is a likely typosquat of 'requests'. Edit distance: 2 (transposed 'ue' -> 'eu') Similarity: 87.5% The legitimate package is 'requests' (800M+ monthly downloads). 'reqeusts' has very low downloads and was likely published to exploit typos. DO NOT install this package. Correct command: pip install requests" ``` --- ## Composite Tools (7 tools, 90 techniques) The AI agent sees only 7 composite tools (~1K tokens), each orchestrating multiple techniques in parallel internally. | Composite Tool | Techniques | Modes | Description | |---|---|---|---| | `vuln_scan` | 24 | `package` `cve` `batch` `recent` `go_module` | Vulnerability intelligence across OSV, GHSA, NVD, EPSS, CISA KEV, Go Vuln DB | | `package_info` | 33 | by ecosystem | Package metadata — auto-dispatches to npm (10), PyPI (4), crates.io (4), Go (3), RubyGems (4), NuGet (4), Packagist (4) | | `dep_tree` | 14 | `dependencies` `dependents` `project` `similar` `search` `full` | Dependency graph intelligence via deps.dev + Libraries.io | | `security_check` | 7 | `typosquat` `compare_names` `provenance` `verify_hash` `search_log` | Supply chain threat detection: typosquatting, provenance, Sigstore | | `quality` | 8 | `scorecard` `badge` `distro` `compare` `full` | Project quality: OpenSSF Scorecard, Best Practices Badge, Repology | | `license` | 3 | `lookup` `batch` `search` | License compliance analysis via ClearlyDefined | | `meta` | 1 | — | List all data sources with configuration status | --- ## Individual Techniques (90) All 90 techniques are accessible via --tool CLI for backward compatibility Run `npx supply-chain-mcp-server --list-all` to see the full list. OSV.dev Vulnerabilities (5) — No API key | Tool | Description | |------|-------------| | `osv_query` | Query OSV database for known vulnerabilities affecting a specific package and optional version | | `osv_query_commit` | Query OSV database for vulnerabilities associated with a specific git commit hash | | `osv_query_purl` | Query OSV database using a Package URL (purl) for known vulnerabilities | | `osv_batch` | Batch query OSV database for vulnerabilities across multiple packages at once | | `osv_id` | Fetch full vulnerability details from OSV by ID (OSV, CVE, GHSA, RUSTSEC, PYSEC, etc.) | GitHub Advisory GHSA (4) — No API key (GITHUB_TOKEN optional for higher rate limits) | Tool | Description | |------|-------------| | `ghsa_id` | Fetch a GitHub Security Advisory by its GHSA or CVE identifier | | `ghsa_search` | Search GitHub Security Advisories by keyword, ecosystem, and severity | | `ghsa_package` | List GitHub Security Advisories affecting a specific package in a given ecosystem | | `ghsa_recent` | List the most recently updated GitHub Security Advisories | NIST NVD (3) — No API key (NVD_API_KEY optional for higher rate limits) | Tool | Description | |------|-------------| | `nvd_cve` | Fetch full CVE details from NVD (NIST National Vulnerability Database) by CVE ID | | `nvd_search` | Search NVD for CVEs by keyword and optional CVSS v3 severity | | `nvd_recent` | Fetch recently published CVEs from NVD within a given number of days | EPSS Exploit Prediction (4) — No API key | Tool | Description | |------|-------------| | `epss_score` | Get EPSS exploit probability and percentile for a single CVE ID | | `epss_batch` | Batch EPSS scores for multiple CVEs (up to 100) in a single request | | `epss_top` | Get the highest EPSS-scoring CVEs (most likely to be exploited) | | `epss_above_threshold` | Find CVEs with EPSS score above a given threshold | CISA KEV (4) — No API key | Tool | Description | |------|-------------| | `kev_lookup` | Check if a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog | | `kev_search` | Search KEV entries by keyword (matched against vendor, product, name, description) | | `kev_recent` | Get recently added KEV entries within the last N days | | `kev_stats` | Get KEV catalog statistics: total count, top vendors, entries per year, and ransomware usage breakdown | npm Registry (10) — No API key | Tool | Description | |------|-------------| | `npm_package` | Fetch npm package metadata including description, latest version, maintainers, license, repository, homepage, and publish timeline | | `npm_version` | Fetch metadata for a specific npm package version including dependencies, dist info (tarball, shasum, integrity), scripts, and deprecation status | | `npm_downloads` | Fetch npm download counts for a package over a given period (last-day, last-week, last-month) | | `npm_search` | Search the npm registry for packages matching a query string | | `npm_maintainers` | Extract maintainers and publish timeline from an npm package — critical for detecting maintainer takeover attacks | | `npm_scripts` | Extract and analyze lifecycle scripts from a specific npm package version — flags suspicious commands (curl, wget, eval, exec, etc.) commonly used in supply-chain attacks | | `npm_provenance` | Check whether an npm pa … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [badchars](https://github.com/badchars) - **Source:** [badchars/supply-chain-mcp-server](https://github.com/badchars/supply-chain-mcp-server) - **License:** MIT - **Homepage:** https://www.npmjs.com/package/supply-chain-mcp-server Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-badchars-supply-chain-mcp-server - Seller: https://agentstack.voostack.com/s/badchars - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.