Attestd MCP server

@attestd/mcp

Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response.

Official Model Context Protocol (MCP) server for Attestd. Exposes CVE risk and supply-chain checks as tools for Claude Code, Claude Desktop, and any MCP-compatible client.

Get a free API key · Full docs

• stdio transport: run via npx -y @attestd/mcp with no global install.
• checkpackagevulnerability: wraps GET /v1/check using @attestd/sdk.
• checkbatchvulnerabilities: checks up to 100 packages in one call. Use for lockfile and manifest audits.
• listcoveredproducts: returns Attestd-covered products. With an API key, returns live data from GET /v1/products. Without a key, returns the static bundled infrastructure list.
• getcvedetails: returns CVSS, EPSS, KEV status, and affected products for a single CVE id.

Prerequisites

• Node.js 18+
• An Attestd API key from the portal. Required for checkpackagevulnerability, checkbatchvulnerabilities, getcvedetails, and live listcoveredproducts.

Claude Code / MCP config

Add to ~/.claude/mcp.json or project .mcp.json:

{
  "mcpServers": {
    "attestd": {
      "command": "npx",
      "args": ["-y", "@attestd/mcp"],
      "env": {
        "ATTESTD_API_KEY": "your-api-key-here"
      }
    }
  }
}

Optional: override the API base URL (e.g. dev):

"env": {
  "ATTESTD_API_KEY": "your-api-key-here",
  "ATTESTD_BASE_URL": "https://dev.api.attestd.io"
}

Tools

checkpackagevulnerability

Returns JSON with:

On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

checkbatchvulnerabilities

Quota is checked upfront. If the batch would exceed your monthly quota, a 429 is returned before any calls are billed.

Shortened. The full README is on GitHub.