Is io.github.attestd-io/attestd-mcp safe to use?

io.github.attestd-io/attestd-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.attestd-io/attestd-mcp?

io.github.attestd-io/attestd-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.

What AI clients work with io.github.attestd-io/attestd-mcp?

io.github.attestd-io/attestd-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is io.github.attestd-io/attestd-mcp actively maintained?

io.github.attestd-io/attestd-mcp is actively maintained — last commit was 9 days ago.

io.github.attestd-io/attestd-mcp

CVE and supply chain checks for MCP clients. Covers infrastructure, PyPI, and npm packages.

GitHub

No known CVEs

No license

Actively maintained

Last commit 9d ago

Works with most clients

Transport: stdio

0 tools

Grade F

MCPpedia last refreshed this data 5h ago

Edit this pageView history

DevOps

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-attestd-io-attestd-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-attestd-io-attestd-mcp-attestd-io)](https://mcppedia.org/s/io-github-attestd-io-attestd-mcp-attestd-io)

Read me

What io.github.attestd-io/attestd-mcp does

Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

31/100across 5 weighted dimensions

How we score →

0255075100

−69

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.attestd-io/attestd-mcp safe to use?: io.github.attestd-io/attestd-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.attestd-io/attestd-mcp?: io.github.attestd-io/attestd-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with io.github.attestd-io/attestd-mcp?: io.github.attestd-io/attestd-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.attestd-io/attestd-mcp actively maintained?: io.github.attestd-io/attestd-mcp is actively maintained — last commit was 9 days ago.

Similar servers

Others in devops

View all →

Mcp Gitlab96

MCP server for using the GitLab API

1.8k 12

io.github.aryaminus/controlkeel92

Governed MCP workflows with policy validation, findings tracking, and review gates.

10 3

Mcp Router90

A Unified MCP Server Management App (MCP Manager).

2.1k 2

Mcp Server Kubernetes90

MCP Server for kubernetes management commands

1.5k 22

MCP Security Weekly

Get CVE alerts and security updates for io.github.attestd-io/attestd-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

DevOps

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-attestd-io-attestd-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-attestd-io-attestd-mcp-attestd-io)](https://mcppedia.org/s/io-github-attestd-io-attestd-mcp-attestd-io)

Read me

What io.github.attestd-io/attestd-mcp does

Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

README

@attestd/mcp

Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response.

Official Model Context Protocol (MCP) server for Attestd. Exposes CVE risk and supply-chain checks as tools for Claude Code, Claude Desktop, and any MCP-compatible client.

Get a free API key · Full docs

stdio transport: run via npx -y @attestd/mcp with no global install.
check_package_vulnerability: wraps GET /v1/check using @attestd/sdk.
check_batch_vulnerabilities: checks up to 100 packages in one call. Use for lockfile and manifest audits.
list_covered_products: returns Attestd-covered products. With an API key, returns live data from GET /v1/products. Without a key, returns the static bundled infrastructure list.
get_cve_details: returns CVSS, EPSS, KEV status, and affected products for a single CVE id.

Prerequisites

Node.js 18+
An Attestd API key from the portal. Required for check_package_vulnerability, check_batch_vulnerabilities, get_cve_details, and live list_covered_products.

Claude Code / MCP config

Add to ~/.claude/mcp.json or project .mcp.json:

{
  "mcpServers": {
    "attestd": {
      "command": "npx",
      "args": ["-y", "@attestd/mcp"],
      "env": {
        "ATTESTD_API_KEY": "your-api-key-here"
      }
    }
  }
}

Optional: override the API base URL (e.g. dev):

"env": {
  "ATTESTD_API_KEY": "your-api-key-here",
  "ATTESTD_BASE_URL": "https://dev.api.attestd.io"
}

Tools

`check_package_vulnerability`

Argument	Type	Description
`product`	string	Product slug (`nginx`, `postgresql`, `litellm`, …)
`version`	string	Exact version (`1.20.0`)

Returns JSON with:

Field	Meaning
`outsideCoverage`	`true` if the product is not covered. Unknown risk, not safe.
`riskState`	`critical` \| `high` \| `elevated` \| `low` \| `none` \| `null` when outside coverage
`activelyExploited`	CISA KEV signal
`remoteExploitable`	`true` if any matching CVE is remotely exploitable
`authenticationRequired`	`true` only when all matching CVEs require authentication
`patchAvailable` / `fixedVersion`	Patch guidance
`confidence`	Synthesis confidence 0.0–1.0
`cveIds`	CVE IDs contributing to the risk assessment
`typosquat`	Package name integrity: typosquat or AI-hallucinated name (`kind`, `resembles`, `likely_intended`)
`message`	Explanation when `outsideCoverage` is true
`supplyChainCompromised` / `supplyChainDescription`	PyPI/npm supply-chain signal

On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

`check_batch_vulnerabilities`

Argument	Type	Description
`items`	array	Array of `{ product, version }` objects. Maximum 100 per call. Each item costs one API call.

Quota is checked upfront. If the batch would exceed your monthly quota, a 429 is returned before any calls are billed.

Returns JSON with count and results. Supported items include the same fields as check_package_vulnerability minus typosquat. Outside-coverage items return only product, version, outsideCoverage: true, and riskState: null.

`list_covered_products`

No arguments. With an API key, returns live JSON from GET /v1/products:

Field	Meaning

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

31/100across 5 weighted dimensions

How we score →

0255075100

−69

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.attestd-io/attestd-mcp safe to use?: io.github.attestd-io/attestd-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.attestd-io/attestd-mcp?: io.github.attestd-io/attestd-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with io.github.attestd-io/attestd-mcp?: io.github.attestd-io/attestd-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.attestd-io/attestd-mcp actively maintained?: io.github.attestd-io/attestd-mcp is actively maintained — last commit was 9 days ago.