Fetter MCP server

Fetter MCP

Fetter provides a remote Model Context Protocol (MCP) server at https://mcp.fetter.io/mcp that gives AI coding agents real-time access to Python package vulnerability data. Built on fetter, it queries PyPI and OSV to surface known CVEs, CVSS scores, and safe versions so your agent can make informed dependency decisions as it writes code.

Tools:

• mostrecentnot_vulnerable: find the latest release of a package that is free of known vulnerabilities
• is_vulnerable: check whether a specific pinned version has known CVEs
• lookup: find available versions and their vulnerabilities for any package or specifier

Installation

The Fetter MCP server uses the HTTP transport and requires no local installation. Just register the remote URL with your MCP client.

Claude Code

claude mcp add --transport http fetter https://mcp.fetter.io/mcp

Codex

codex mcp add fetter --url https://mcp.fetter.io/mcp

Other MCP Clients

For any other MCP-compatible client, provide the following remote server URL using the HTTP transport:

https://mcp.fetter.io/mcp

Agent Usage

Once installed, the Fetter MCP tools are available to your AI agent during coding sessions. The agent can call them automatically when adding or auditing dependencies; no explicit tool invocation is required in your prompts.

Example prompts

• "Add the latest safe version of requests to requirements.txt"
• "Are there any known vulnerabilities in my current dependencies?"
• "What is the most recent version of pillow with no CVEs?"
• "Before pinning cryptography, check whether 42.0.5 is vulnerable"

The agent selects the appropriate tool based on context:

• Adding a new package: mostrecentnot_vulnerable to find a safe version
• Validating a specific pinned version: is_vulnerable for a definitive answer
• Auditing an existing specifier: lookup to see affected versions

mostrecentnot_vulnerable

Find the most recent version of a package that has no known vulnerabilities. Provide only a package name and the server will search recent releases for a safe version. Useful when pinning a dependency to the latest clean release.

Parameters

• package_name — package name only (no version specifier), e.g. "requests"

Example Request

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 2,
  "params": {
    "name": "most_recent_not_vulnerable",
    "arguments": {
      "name": "cryptography"
    }
  }
}

Example Response:

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [],
    "structuredContent": {
      "package": "cryptography",
      "version": "46.0.5",
      "vulnerabilities": [],
      "vulnerable": false
    },
    "isError": false
  }
}

is_vulnerable

Check if a specific package version has known vulnerabilities. Requires an exact version specifier. Returns vulnerability IDs, summaries, CVSS scores, severity ratings, and reference URLs.

Parameters

• dep_spec — exact version specifier, e.g. "requests==2.31.0"

Example Request

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 2,
  "params": {
    "name": "is_vulnerable",
    "arguments": {
      "name": "requests==2.19.1"
    }
  }
}

Shortened. The full README is on GitHub.