Attestd - Deterministic CVE & Supply Chain Data
About
Deterministic, machine-readable CVE and supply chain risk data for infrastructure, PyPI, and npm packages. Built for AI agents and coding assistants to act on directly, no CVSS interpretation required. Covers nginx, PostgreSQL, Redis, Docker, Kubernetes, and more.
Details
- Author
- attestd-io
- Downloads
- 264
- Categories
- Security, AI
Jump to
- Check a single package version for CVEs and supply-chain risks
- Batch-check up to 100 packages in one call (lockfile/manifest audits)
- Query covered products (live or static bundled list)
- Retrieve full CVE details including CVSS, EPSS, CISA KEV status
- Structured JSON response with risk state, patch guidance, and confidence
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Attestd - Deterministic CVE & Supply Chain DataCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Run the server via npx -y @attestd/mcp and configure an API key in the ATTESTD_API_KEY environment variable inside your MCP client’s configuration (e.g., ~/.claude/mcp.json). The server exposes four tools: check_package_vulnerability, check_batch_vulnerabilities, list_covered_products, and get_cve_details.
check_package_vulnerability
Check whether a software package or infrastructure product version has known CVE vulnerabilities or a confirmed supply chain compromise. Call this before adding, updating, or recommending any npm, PyPI, or infrastructure dependency, including mid-conversation when a developer asks about installing or upgrading a package. outsideCoverage=true means Attestd has no data for that product; treat as unknown risk, not safe. Covers infrastructure products (nginx, PostgreSQL, Redis, Docker, Kubernetes, etc.) and PyPI/npm packages.
list_covered_products
Returns infrastructure product slugs covered by Attestd for CVE checks. PyPI and npm packages also work with check_package_vulnerability even when absent from this list. Call this first if you are unsure whether an infrastructure slug is supported. Uses a static bundled list. No /v1/check API call for this tool.
check_batch_vulnerabilities
Check up to 100 software packages or infrastructure products in a single request. Each item is billed as one API call. Use this instead of multiple check_package_vulnerability calls when you need to audit a lockfile, manifest, or dependency list. Items outside Attestd coverage return outsideCoverage=true and should be treated as unknown risk, not safe. A 429 is returned before any results are delivered if the batch would exceed your monthly quota; no calls are billed in that case.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"attestd - deterministic cve & supply chain data": {
"attestd": {
"command": "npx",
"args": [
"-y",
"@attestd/mcp"
],
"env": {
"ATTESTD_API_KEY": "<YOUR_API_KEY>"
}
}
}
}
}McpServers
{
"attestd": {
"command": "npx",
"args": [
"-y",
"@attestd/mcp"
],
"env": {
"ATTESTD_API_KEY": "<YOUR_API_KEY>"
}
}
}Deterministic CVE and supply chain risk data for any package or infrastructure component, returned as fields an AI agent or coding assistant can branch on directly. No CVSS scores to interpret, no human in the loop required.
Tools
- check_package_vulnerability -check a single package or infrastructure product by slug and version, returns risk state, active exploitation status, patch availability, and supply chain compromise signal
- check_batch_vulnerabilities -check up to 100 packages in one call, use for lockfile or dependency manifest audits instead of looping the single-check tool
- list_covered_products -list all 350+ covered infrastructure products by slug, useful to confirm a slug before checking it
Setup
Get a free API key at api.attestd.io/portal/login.
Coverage
- 350+ infrastructure and platform products: databases, web servers, container runtimes, message queues, language runtimes, auth/identity, CI/CD, and more
- PyPI and npm supply chain, 250,000+ packages, growing continuously
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
