Open-Source MCP Vulnerability Advisory Database

An open-source, automated Open Source Vulnerability (OSV 1.6) compliant security advisory database specifically curated for the Model Context Protocol (MCP) ecosystem.

Sources

• CVE List v5: Official CVE JSON 5.0 records.
• GitHub Security Advisories (GHSA): Live GraphQL/REST security alerts.
• OSV.dev: Unified open-source vulnerability database.
• National Vulnerability Database (NVD): CVE 2.0 vulnerability metrics and CVSS scores.

Fast Consumption

You can fetch the complete vulnerability database snapshot in a single GET request:

curl -sL https://raw.githubusercontent.com/JMartynov/mcp-vulnerabilities/main/vulnerabilities.json.gz | gzip -d > vulnerabilities.json

Python

import gzip, json, urllib.request

url = "https://raw.githubusercontent.com/JMartynov/mcp-vulnerabilities/main/vulnerabilities.json.gz"
with urllib.request.urlopen(url) as resp:
    with gzip.GzipFile(fileobj=resp) as gz:
        data = json.load(gz)

print(f"Loaded {data['total_vulnerabilities']} MCP security advisories.")

CI/CD Integration

You can easily prevent vulnerable MCP server dependencies from entering your production environment or being configured into AI client settings by adding this official, reusable GitHub Action to your CI workflows.

Audit AI Client Configurations

- name: Audit MCP Servers
  uses: JMartynov/mcp-vulnerabilities@v1
  with:
    config-path: ".claude/claude_desktop_config.json"
    fail-on-severity: "HIGH"

Audit Dependency Manifests

- name: Audit Transitive Dependencies
  uses: JMartynov/mcp-vulnerabilities@v1
  with:
    manifest-path: "package.json"
    fail-on-severity: "HIGH"

CLI Usage

# Ingest latest advisories from live APIs
python -m mcp_vulnerabilities.cli sync --live-api

# Validate OSV schema compliance
python -m mcp_vulnerabilities.cli validate --dir data/vulnerabilities

# Compile compressed snapshot
python -m mcp_vulnerabilities.cli snapshot

Documentation

• Specification: Details the OSV 1.6 schema extensions, semantics, and vulnerability invariants.
• Implementation: Architecture blueprint covering ingestion pipelines, state machines, and acceptance tests.

Testing

Execute the acceptance test suite to validate the end-to-end functionality:

uv run pytest -v tests/test_acceptance_*.py

Publishing to PyPI

Final Optional Step: Tagging v1.0.0 for PyPI

When you're ready to publish the inaugural release to PyPI:

1. Ensure your PyPI account has a Pending Publisher configured:
   • Owner: JMartynov
   • Repository: mcp-vulnerabilities
   • Workflow name: release.yaml
   • Environment: pypi (or Any)
2. Create and push the release tag:

   git tag -a v1.0.0 -m "Release v1.0.0: Inaugural open-source MCP vulnerability database & CLI"
   git push origin v1.0.0
   

License

MIT