DataNexus MCP

From any MCP client connected to DataNexus:

apikeys_generate_api_key(email="you@example.com")

Returns adnx_...key. Store it — it is shown only once.

{ "mcpServers": { "datanexus": { "type": "http", "url": "https://datanexusmcp.com/mcp", "headers": { "X-DataNexus-Key": "dnx_your_key_here" } } } }

npx / stdio clients:pass the key as an environment variable or use the HTTP config above.

Security engineersauditing SBOMs against CISA KEV, triaging CVEs with instant CRITICAL/HIGH/MODERATE/LOW verdicts, scanning CI pipelines for exposed secrets, and checking licence compatibility across their entire dependency list — without leaving their AI client.

Frontend developerscatching typosquats against the top-500 frontend corpus, auditingpackage.jsonfor supply-chain risk before shipping, and getting one-verdict package risk briefs scoped to npm.

Compliance analystsrunning background checks across IRS, SAM.gov, and NPPES — manually 45 minutes, with DataNexus 4 minutes.

Nonprofit researchers and grant-makersdiscovering organizations by category, tracking 5-year revenue trends, and running full 990-based due diligence — in one conversation.

M&A and legal teamsdoing due diligence on organizations — SAM exclusion checks, contract history, NPI verification, and patent portfolio in a single Claude conversation.

Copy any of these into Claude after connecting DataNexus:

"Generate a DataNexus API key for me using my email address."

"Check the licences of requests, flask, and numpy. Are they compatible for use in a commercial SaaS product?"

"Get the full risk summary for CVE-2021-44228 — CVSS, CISA KEV status, EPSS probability, and patch availability in one call."

"Audit my package.json for supply-chain risk — check for critical CVEs, licence issues, and abandoned packages."

"Scan this GitHub Actions workflow for exposed secrets, unpinned actions, and missing lockfile enforcement."

"Find education nonprofits in California, pick one, and show me their 5-year revenue trend."

"Check all my active CVE watches for new events since my last poll."

Security & Vulnerability Intelligence (T10)

Licence Intelligence & CVE Aggregator

New in Sprint 8B. Frontend-specific security tools scoped to the npm ecosystem with a curated top-500 frontend package corpus.

Differentiator vs mcp-security-audit:DataNexus frontend tools return one actionable verdict (SHIP/CAUTION/BLOCK) with licence risk and abandonment signals, not a raw CVE dump.

Compliance & Identity Verification (T22)

Hosted (recommended — no setup required)

No Docker, no API keys, no configuration.

{ "mcpServers": { "datanexus": { "type": "http", "url": "https://datanexusmcp.com/mcp" } } }

With a registered API key (500 calls/month)

{ "mcpServers": { "datanexus": { "type": "http", "url": "https://datanexusmcp.com/mcp", "headers": { "X-DataNexus-Key": "dnx_your_key_here" } } } }

Via npx (stdio clients — Claude Desktop, Cursor)

10 new tools — API key infrastructure, backend security depth, frontend security wedge

- apikeys_generate_api_key— issue a freednx_...key tied to your email (500 calls/month)
- apikeys_rotate_api_key— atomic key rotation
- apikeys_revoke_api_key— immediate revocation + Redis cache invalidation
- _UsageMiddleware— usage counting injected into every tool response at middleware level. Zero changes to existing tool files
- Anonymous tier: 100 calls/month (IP-keyed). Registered tier: 500 calls/month (key-keyed)
- PAYMENT_ENABLEDflag: soft gate today → hard 429 when payment is enabled (env var flip, no code change)

Sprint 8B — Sub-category Taxonomy + Backend Security Depth + Frontend Security Wedge:

- security_audit_sbom_license_policy— SBOM → PASS/WARN/BLOCK per org licence policy (CycloneDX/SPDX). Default policy blocks GPL-3.0/AGPL-3.0. Unlisted licences default to WARN
- security_fetch_cve_watch_status— CVE watch polling inbox with per-user cursor. Returns only new events since last poll
- security_fetch_dependency_graphenhanced —cvs_filtered_transitive_depsfield added: transitive deps with ≥1 open CVE highlighted via OSV.dev cross-check
- frontend_security_detect_typosquatting— DL-distance ≤ 2 against curated top-500 frontend corpus
- frontend_security_audit_manifest—package.json→ SHIP/CAUTION/BLOCK with licence risks and abandonment signals
- frontend_security_audit_ci_pipeline— GitHub Actions/Vercel/Netlify secret scanner.${{ secrets.X }}safe refs never flagged
- frontend_security_fetch_package_risk_brief— npm-scoped risk brief withweekly_downloadsandis_ui_componentsignals
- CATEGORIES.md— 8-category tool taxonomy added to repo

5 new tools — licence intelligence, CVE aggregator, nonprofit depth

- security_fetch_licence_analysis,security_audit_licence_compatibility,security_fetch_cve_risk_summary
- nonprofit_search_nonprofits_by_category,nonprofit_fetch_nonprofit_financial_trends

6 new tools — package risk, maintainer health, stateful CVE/SBOM monitoring

- security_fetch_package_risk_brief,security_fetch_package_maintainer_history,security_detect_typosquatting
- security_fetch_cve_watch,security_audit_sbom_continuous,nonprofit_fetch_nonprofit_full_profile

Added CISA KEV, EPSS, and SBOM audit tools (35 tools total).

- ✅ Free to use for personal projects, research, and self-hosting your own instance
- ✅ Free to read, modify, and learn from the source code
- ✅ Converts automatically to Apache 2.0 on 2030-06-11 — no strings attached after that
- ❌ Cannot be used to offer a competing hosted data intelligence service without a commercial license

We're building a sustainable hosted service on top of this codebase. BSL lets us keep the source open and auditable — important for a tool handling compliance and security data — while protecting the ability to fund continued development.

Allows access to DFIR / forensics data that was analyzed by the open source Autopsy platform

Connect to your CISO Adapt workspace to search, analyse, export, and manage risks and policies with natural language

EPA air quality monitoring and HUD foreclosure data. 3 MCP tools for environmental and housing data

MCP-native OSINT framework for AI agents. Exposes 9 intelligence tools (email enumeration, username search, breach check, WHOIS, IP intel, subdomain enum, dorks, paste search, phone intel) via Model Context Protocol. Also works as a standalone Python CLI.

Unmodified government company registry data — 27 national registries, live. Cross-border UBO / beneficial owner chain walker for KYC, AML, due diligence. 27 tools + 10 MCP prompt workflows.

Real-time OSINT intelligence platform for global security monitoring.

URL intelligence for AI agents. 13 tools for security signals and data quality checks. Analyses URLs across 7 dimensions: redirect behaviour, brand impersonation, domain age, SSL/TLS, parked detection, URL structure, DNS enrichment. Risk score 0-100 with 23 configurable weights.

Paid remote MCP for agent data-access boundary reviews, permission scope evidence, sensitive data notes, and governance receipts.

EXIF for AI. AKF embeds trust scores, source provenance, and compliance metadata into every file your AI touches — DOCX, PDF, images, code, and 20+ formats. 9 MCP tools: stamp, inspect, trust, audit, scan, embed, extract, detect. Audit against EU AI Act, SOX, HIPAA, NIST in one command.