Mmcp.market

TridentChain Security MCP server

by DevInder1·io.github.DevInder1/tridentchain-security·v0.1.5
No reviews yet

Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload.

A88/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A88/100

full report

Adoption
New

0 stars25 downloads/wk

Reviews

Write one

Nobody has reviewed TridentChain Security yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

TridentChain Security tools (3, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • scan_full

    Comprehensive scan covering THREE surfaces in one call that project-only scanners cannot reach: (1) project dependencies (npm, PyPI), (2) OS/system packages (Homebrew on macOS, apt/dnf on Linux), and (3) installed IDE extensions (VS Code marketplace + JetBrains plugins). Use this whenever the user asks for "complete coverage", a "full audit", scanning their "whole machine" or "system", or wants to

  • scan_project

    Scan project dependencies for CVEs and rank findings by REAL-WORLD EXPLOITATION RISK using EPSS (exploit probability) and the CISA KEV (Known Exploited Vulnerabilities) catalog — not just CVSS severity. Best for: when the user wants to know which CVEs to fix FIRST, asks about supply-chain risk in an IDE/conversational context, or wants to pair with validate_after_patch for a confirmed-fix workflow

  • validate_after_patchwrite action

    Confirm that dependency upgrades actually resolved the CVEs they were supposed to fix. Use this whenever the user says they ran `npm update`, `pip install -U`, or applied a patch and wants verification — chain it with two scan_project calls (before/after) or pass two saved scan JSON results. This is unique to TridentChain; most other supply-chain scanners only report findings without a verifiable

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • Code scan4 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 57 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 88/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

What the publisher says

From the TridentChain Security repository's README, as published. We do not edit it. Read it on GitHub

TridentChain Security

Local-first vulnerability scanner for project dependencies, developer tools, and IDE extensions. Uses multi-source intelligence (OSV, NVD, GHSA, Sonatype) with KEV/EPSS prioritization.

No API key required for default usage.

Public repo: https://github.com/DevInder1/supply-chain-scanner-public

Install (plug and play)

pip3 install tridentchain-security
npm install -g @tridentchain/security-cli
tridentchain-security --help

Agents & MCP (Claude, Cursor, VS Code, Windsurf, Zed):

Pick whichever install path fits:

# Option A — pip (needs Python 3.10+)
pip3 install -U "tridentchain-security>=0.1.4" "tridentchain-mcp>=0.1.4"

# Option B — uvx (no manual Python install; uv handles it)
uvx tridentchain-mcp

# Option C — Docker (no Python needed, fully sandboxed)
docker pull ghcr.io/devinder1/tridentchain-mcp:latest
# Then in your MCP config, replace `python3 -m tridentchain_mcp` with:
#   command: docker
#   args: ["run", "--rm", "-i", "-v", "$PWD:/workspace", "ghcr.io/devinder1/tridentchain-mcp:latest"]

What you can do: docs/CAPABILITIES.md Full guide: docs/INSTALLANDUSE.md Cross-platform (macOS / Linux / Windows): docs/CROSSPLATFORM.md** (PyPI: tridentchain-security · npm: @tridentchain/security-cli)

tridentchain-security --scan all --project-path . --output-dir scanner-output

Use in your own Python app

from scanner import run_scan

summary = run_scan(
    project_path=".",
    scan="all",
    run_profile="full",  # no API key required
    output_dir="scanner-output",
)
print(summary["summary"])

Scan profiles

Desktop app (individual application)

No repo clone required if the pip package is installed:

pip3 install tridentchain-security
cd apps/desktop && npm install && npm run start

See apps/desktop/README.md and docs/DISTRIBUTION_VERIFICATION.md.

AI / automation (Claude, OpenAI, Cursor, VS Code, Windsurf, …)

One install, every agent: pip install "tridentchain-security>=0.1.2" tridentchain-mcp

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Install directly

claude mcp add tridentchain-security -- uvx tridentchain-mcp
Add to Cursor

TridentChain Security: common questions

Is TridentChain Security MCP server safe?
Yes, by our scan: it is graded A (88/100). Read the TridentChain Security safety report
How do I install TridentChain Security?
It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does TridentChain Security need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is TridentChain Security maintained?
The last commit was 57 days ago (2026-07-29). The latest release is v0.1.5.
What can I use instead of TridentChain Security?
Servers from other publishers that do the same job: Security Intel MCP server, ScanLabsAI Security Scanner MCP server and CodeInspectus MCP server. Compare all TridentChain Security alternatives.

Alternatives to TridentChain Security

Same job from other publishers: the closest match first, then the best rated.

All TridentChain Security alternatives →
  • Security Intel MCP
    CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
    A
  • ScanLabsAI Security Scanner
    Scan a website for vulnerabilities: OWASP Top 10, CVEs, SSL, headers - with plain-English fixes
    B
  • CodeInspectus
    Local-first MCP security scanner and CLI for AI-generated applications.
    C
  • pkgxray
    Pre-install security scans for npm packages, MCP servers, and AI agents with cited verdict evidence.
    B
  • MCP
    Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
    A
TridentChain Security vs Security Intel MCPTridentChain Security vs ScanLabsAI Security ScannerTridentChain Security vs CodeInspectus

More from DevInder1 →