How do I install Attestd?

Attestd is a local plugin. Install it using npm package: @attestd/mcp and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Attestd safe to use?

Attestd scored 6.2/10 (moderate risk) in MCP Marketplace's automated security scan. It has 2 high or critical findings to review. It's listed, but review the security report on this page before installing.

What credentials does Attestd need?

Attestd requires the following credentials or environment variables: ATTESTD_API_KEY, ATTESTD_BASE_URL. You can find setup instructions on the server detail page.

What AI apps work with Attestd?

Attestd uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Attestd MCP Server

by Attestd Io

Developer ToolsModerate6.2MCP RegistryLocal

Free

Server data from the Official MCP Registry

CVE and supply chain checks for MCP clients. Covers infrastructure, PyPI, and npm packages.

About

CVE and supply chain checks for MCP clients. Covers infrastructure, PyPI, and npm packages.

Security Report

6.2

Moderate6.2Moderate Risk

This MCP server is well-designed with proper authentication, minimal attack surface, and appropriate input validation. The server requires an Attestd API key for sensitive operations, handles errors gracefully, and all network calls are scoped to the Attestd API. Minor code quality observations around error handling breadth do not materially impact security. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

7 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

What You'll Need

Set these up before or after installing:

Attestd API key (atst_...). Required for check_package_vulnerability and check_batch_vulnerabilities. Get one at https://api.attestd.io/portalRequired

Environment variable: ATTESTD_API_KEY

Optional API base URL override. Defaults to https://api.attestd.ioOptional

Environment variable: ATTESTD_BASE_URL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-attestd-io-attestd-mcp": {
      "env": {
        "ATTESTD_API_KEY": "your-attestd-api-key-here",
        "ATTESTD_BASE_URL": "your-attestd-base-url-here"
      },
      "args": [
        "-y",
        "@attestd/mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

@attestd/mcp

Attestd checks whether a dependency version has exploitable CVEs or a confirmed supply-chain compromise. One API call returns a structured risk response.

Official Model Context Protocol (MCP) server for Attestd. Exposes CVE risk and supply-chain checks as tools for Claude Code, Claude Desktop, and any MCP-compatible client.

Get a free API key · Full docs

stdio transport: run via npx -y @attestd/mcp with no global install.
check_package_vulnerability: wraps GET /v1/check using @attestd/sdk.
check_batch_vulnerabilities: checks up to 100 packages in one call. Use for lockfile and manifest audits.
list_covered_products: returns Attestd-covered products. With an API key, returns live data from GET /v1/products. Without a key, returns the static bundled infrastructure list.
get_cve_details: returns CVSS, EPSS, KEV status, and affected products for a single CVE id.

Prerequisites

Node.js 18+
An Attestd API key from the portal. Required for check_package_vulnerability, check_batch_vulnerabilities, get_cve_details, and live list_covered_products.

Claude Code / MCP config

Add to ~/.claude/mcp.json or project .mcp.json:

{
  "mcpServers": {
    "attestd": {
      "command": "npx",
      "args": ["-y", "@attestd/mcp"],
      "env": {
        "ATTESTD_API_KEY": "your-api-key-here"
      }
    }
  }
}

Optional: override the API base URL (e.g. dev):

"env": {
  "ATTESTD_API_KEY": "your-api-key-here",
  "ATTESTD_BASE_URL": "https://dev.api.attestd.io"
}

Tools

`check_package_vulnerability`

Argument	Type	Description
`product`	string	Product slug (`nginx`, `postgresql`, `litellm`, …)
`version`	string	Exact version (`1.20.0`)

Returns JSON with:

Field	Meaning
`outsideCoverage`	`true` if the product is not covered. Unknown risk, not safe.
`riskState`	`critical` \| `high` \| `elevated` \| `low` \| `none` \| `null` when outside coverage
`activelyExploited`	CISA KEV signal
`remoteExploitable`	`true` if any matching CVE is remotely exploitable
`authenticationRequired`	`true` only when all matching CVEs require authentication
`patchAvailable` / `fixedVersion`	Patch guidance
`confidence`	Synthesis confidence 0.0–1.0
`cveIds`	CVE IDs contributing to the risk assessment
`typosquat`	Package name integrity: typosquat or AI-hallucinated name (`kind`, `resembles`, `likely_intended`)
`message`	Explanation when `outsideCoverage` is true
`supplyChainCompromised` / `supplyChainDescription`	PyPI/npm supply-chain signal

On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

`check_batch_vulnerabilities`

Argument	Type	Description
`items`	array	Array of `{ product, version }` objects. Maximum 100 per call. Each item costs one API call.

Quota is checked upfront. If the batch would exceed your monthly quota, a 429 is returned before any calls are billed.

Returns JSON with count and results. Supported items include the same fields as check_package_vulnerability minus typosquat. Outside-coverage items return only product, version, outsideCoverage: true, and riskState: null.

`list_covered_products`

No arguments. With an API key, returns live JSON from GET /v1/products:

Field	Meaning
`source`	`"live"` when fetched from the API
`total`	Combined count of CVE products and supply chain packages
`cveProducts`	CVE infrastructure slugs with display names
`supplyChainPackages`	Monitored PyPI/npm packages

Without an API key, returns the static bundled list:

Field	Meaning
`source`	`"static"`
`count`	Number of bundled infrastructure products
`products`	Array of `{ slug, display }` entries

`get_cve_details`

Argument	Type	Description
`cve_id`	string	CVE identifier, e.g. `CVE-2021-44228`

Returns JSON with:

Field	Meaning
`found`	`true` when the CVE is in Attestd's database; `false` on 404 (not an error)
`cveId`	CVE identifier
`description`	NVD description text
`cvssScore` / `cvssVector`	CVSS base score and vector
`activelyExploited`	CISA KEV signal
`remoteExploitable`	Remotely exploitable
`authenticationRequired`	Authentication required for exploitation
`affectedProducts`	Attestd product slugs affected by this CVE
`epssScore` / `epssPercentile`	EPSS probability and percentile
`sourcePublishedAt` / `lastCheckedAt`	ISO timestamps

When the CVE is not found, returns { "found": false, "cveId": "..." } without isError. On invalid/missing API key or rate limit, returns isError: true with a JSON error string.

Verify locally

npm run build
echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | node dist/index.js

License

MIT. See LICENSE.

Reviews

No reviews yet

Be the first to review this server!

More Developer Tools MCP Servers

Fetch

Free

by Modelcontextprotocol · Developer Tools

Web content fetching and conversion for efficient LLM usage

Git

Free

by Modelcontextprotocol · Developer Tools

Read, search, and manipulate Git repositories programmatically

Toleno

Free

by Toleno · Developer Tools

Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.

mcp-creator-python

Free

by mcp-marketplace · Developer Tools

Create, build, and publish Python MCP servers to PyPI — conversationally.

MarkItDown

Free

by Microsoft · Content & Media

Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.

Attestd MCP Server

About

Security Report

Findings (6)Action required

Permissions Required

What You'll Need

How to Install

Documentation

@attestd/mcp

Prerequisites

Claude Code / MCP config

Tools

check_package_vulnerability

check_batch_vulnerabilities

list_covered_products

get_cve_details

Verify locally

License

Reviews

No reviews yet

More Developer Tools MCP Servers

Fetch

Git

Toleno

mcp-creator-python

MarkItDown

MCP Marketplace

`check_package_vulnerability`

`check_batch_vulnerabilities`

`list_covered_products`

`get_cve_details`