Skip to content
Agentmart
Submit a tool

Attestd MCP

CVE checks, supply chain signals, live catalog, and CVE detail for MCP clients (infra, PyPI, npm).

Connector by attestd-io · GitHub account verified by the MCP Registry

IndexedMITLocal (stdio)
Write a review

Install

Works with Claude Code, Codex, VS Code, Cursor, Windsurf, Claude Desktop. Read the repository before you give any tool access to your data.

npx agentmarket install connector/attestd-io-attestd-mcp

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

We use your email only for this newsletter. Privacy

About

CVE checks, supply chain signals, live catalog, and CVE detail for MCP clients (infra, PyPI, npm).

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions

What this server can do and what it asks for, from its tool list and install config. Checked Oct 25, 2026.

Tools
5 read · 0 write · 0 deleteRead-only
Secrets
1 (API keys, tokens or passwords)
Install scripts
Not scanned yet
Runs as
Node.js package

Tools by what they do 5

Read from the source code; the running server may list different tools.

Read 5 · Look things up without changing anything.

  • check_batch_vulnerabilities
  • check_package_vulnerability
  • get_cve_details
  • get_usage
  • list_covered_products

Secrets and settings it asks for

Secrets: values you paste in that let it act as you.

  • ATTESTD_API_KEY

Other settings (environment variables or headers).

  • ATTESTD_BASE_URL

Tools (5)

Read from the source code; the running server may differ. Descriptions are the server’s own words; hidden characters are shown as [U+…].

  • check_batch_vulnerabilitiesread-only

    Check up to 100 software packages or infrastructure products in a single request. Each item is billed as one API call. Use this instead of multiple check_package_vulnerability calls when you need to audit a lockfile, manifest, or dependency list. Items outside Attestd coverage return outsideCoverage=true and should be treated as unknown risk, not safe. A 429 is returned before any results are delivered if the batch would exceed your monthly quota; no calls are billed in that case.

  • check_package_vulnerabilityread-only

    Check whether a software package or infrastructure product version has known CVE vulnerabilities or a confirmed supply chain compromise. Call this before adding, updating, or recommending any npm, PyPI, or infrastructure dependency, including mid-conversation when a developer asks about installing or upgrading a package. outsideCoverage=true means Attestd has no data for that product; treat as unknown risk, not safe. Covers infrastructure products (nginx, PostgreSQL, Redis, Docker, Kubernetes, etc.) and PyPI/npm packages.

  • get_cve_detailsread-only

    Return full details for a single CVE id (CVSS, EPSS, KEV status, affected products). Use when you need context on a specific CVE before recommending a patch or explaining risk to a developer.

  • get_usageread-only

    Return Attestd API quota for the authenticated key: calls used this month, included cap, billing period, and overage. Call this before a large check_batch_vulnerabilities audit so you do not hit a 429 mid-lockfile.

  • list_covered_productsread-only

    Returns Attestd-covered products for CVE checks. With an API key, returns live data from GET /v1/products (CVE infrastructure slugs plus monitored supply chain packages). Without a key, returns the static bundled infrastructure list. PyPI and npm packages also work with check_package_vulnerability even when absent from this list.

Signals

Stars
0
Forks
0
Open issues
0
Weekly downloads
35
Last commit
Oct 8, 2026 (20 days ago)
Last release
Sep 26, 2026 (1 month ago)
Last package publish
Oct 8, 2026 (20 days ago)

From GitHub (fetched Oct 24, 2026) and the package registry.

Details

Registry name
io.github.attestd-io/attestd-mcp
Version
0.3.1
Auth
API key
Packages
npm @attestd/mcp
License
MIT
Repository
github.com/attestd-io/attestd-mcp
First seen
Oct 24, 2026
Last checked
Oct 25, 2026
Source
Official MCP Registrygithub-graphql
Cite this page

Attestd MCP. Agent Mart. https://agentmart.dev/connectors/attestd-io-attestd-mcp (last updated 2026-10-25)