Fetter MCP

Fetter provides a remoteModel Context Protocol(MCP) server athttps://mcp.fetter.io/mcpthat gives AI coding agents real-time access to Python package vulnerability data. Built onfetter, it queries PyPI and OSV to surface known CVEs, CVSS scores, and safe versions so your agent can make informed dependency decisions as it writes code.

claude mcp add --transport http fetter https://mcp.fetter.io/mcp

codex mcp add fetter --url https://mcp.fetter.io/mcp

{ "jsonrpc": "2.0", "method": "tools/call", "id": 2, "params": { "name": "most_recent_not_vulnerable", "arguments": { "name": "cryptography" } } }

{ "jsonrpc": "2.0", "id": 2, "result": { "content": [], "structuredContent": { "package": "cryptography", "version": "46.0.5", "vulnerabilities": [], "vulnerable": false }, "isError": false } }

Check if a specific package version has known vulnerabilities. Requires an exact version specifier. Returns vulnerability IDs, summaries, CVSS scores, severity ratings, and reference URLs.

- dep_spec— exact version specifier, e.g."requests==2.31.0"

{ "jsonrpc": "2.0", "method": "tools/call", "id": 2, "params": { "name": "is_vulnerable", "arguments": { "name": "requests==2.19.1" } } }

{ "jsonrpc": "2.0", "id": 2, "result": { "content": [], "structuredContent": { "package": "requests", "version": "2.19.1", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" }, { "cvss_score": 5.6, "id": "GHSA-9wx4-h78v-vm56", "severity": "(Medium):", "summary": "Requests Session object does not verify requests after making first request with verify=False", "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56" }, { "cvss_score": 6.1, "id": "GHSA-j8r2-6x86-q33q", "severity": "(Medium):", "summary": "Unintended leak of Proxy-Authorization header in requests", "url": "https://osv.dev/vulnerability/GHSA-j8r2-6x86-q33q" }, { "cvss_score": 7.5, "id": "GHSA-x84v-xcm2-53pg", "severity": "(High):", "summary": "Insufficiently Protected Credentials in Requests", "url": "https://osv.dev/vulnerability/GHSA-x84v-xcm2-53pg" }, { "cvss_score": null, "id": "PYSEC-2018-28", "severity": null, "summary": "", "url": "https://osv.dev/vulnerability/PYSEC-2018-28" }, { "cvss_score": null, "id": "PYSEC-2023-74", "severity": null, "summary": "", "url": "https://osv.dev/vulnerability/PYSEC-2023-74" } ], "vulnerable": true }, "isError": false } }

Look up a package by name and optional version specifier to find which versions are available and whether they have known vulnerabilities. Supports specifiers such as"requests","numpy>=2.0", or"flask==3.0.0".

- dep_specs— package name or version specifier
- cvss_threshold— filter to vulnerabilities at or above this CVSS score (0–10)
- max_observed_score— return only the highest CVSS score per version rather than all individual vulnerabilities
- count— limit the number of recent versions checked
- retain_passing— include versions with no known vulnerabilities in the results

{ "jsonrpc": "2.0", "method": "tools/call", "id": 2, "params": { "name": "lookup", "arguments": { "name": "requests>=2.32.0", "retain_passing": true } } }

{ "jsonrpc": "2.0", "id": 2, "result": { "content": [], "structuredContent": { "package": "requests", "versions": [ { "version": "2.32.0", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" } ], "vulnerable": true }, { "version": "2.32.1", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" } ], "vulnerable": true }, { "version": "2.32.2", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" } ], "vulnerable": true }, { "version": "2.32.3", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" } ], "vulnerable": true }, { "version": "2.32.4", "vulnerabilities": [], "vulnerable": false }, { "version": "2.32.5", "vulnerabilities": [], "vulnerable": false } ] }, "isError": false } }

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Model Context Protocol Servers Repository for OpenZeppelin Products

Enable AI agents to secure code with Semgrep.

Model Context Protocol server for Skycloak managed Keycloak. Manage clusters, realms, applications, SSO and users from any MCP client.

Dependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.

Security scanner for MCP servers and AI agent tooling. Detects prompt injection, command injection, auth bypass, and excessive permissions.

Remote MCP server (Streamable HTTP) at https://mcp.agenticrail.nz/ — deterministic step-order enforcement for AI agents. evaluate_step returns ALLOW or DENY before a step runs; verify_receipt proves a sequence's Ed25519-signed, hash-chained receipt chain is intact. No auth required: omit the bearer token and calls run on the public demo key. That first clause matters — the form has no "remote/hosted" field, and putting the endpoint in the description is the convention on that list ("Fully REMOTE! Just use…"). The rest mirrors your own server card verbatim, so the listing and the card can't drift.

An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.

Deterministic security preflight for AI agents. Check URLs, files and shell commands before acting.

AI-powered code quality analysis to detect best practice violations, security issues, and architectural problems in real-time.