# Fetter MCP [Health: Active] **Category:** 🔒 Security **Repository:** https://github.com/fetter-io/fetter-mcp **GitHub Stars:** 1 **Views:** 0 **Installs:** 0 **Upvotes:** 0 **Directory Page:** https://allmcps.com/mcp/fetter-mcp ## Description Real-time Python package and vulnerability data for AI coding agents. ## Claude Desktop Quick Installation Remote MCP endpoint (confidence: high). Install path detected from listing signals. Add as a URL/SSE server in your client: ```json "mcpServers": { "fetter-mcp": { "url": "https://modelcontextprotocol.io" } } ``` ## Documentation & README # Fetter MCP Fetter provides a remote [Model Context Protocol](https://modelcontextprotocol.io) (MCP) server at `https://mcp.fetter.io/mcp` that gives AI coding agents real-time access to Python package vulnerability data. Built on [fetter](https://github.com/fetter-io/fetter-rs), it queries PyPI and OSV to surface known CVEs, CVSS scores, and safe versions so your agent can make informed dependency decisions as it writes code. **Tools:** - `most_recent_not_vulnerable`: find the latest release of a package that is free of known vulnerabilities - `is_vulnerable`: check whether a specific pinned version has known CVEs - `lookup`: find available versions and their vulnerabilities for any package or specifier ## Installation The Fetter MCP server uses the HTTP transport and requires no local installation. Just register the remote URL with your MCP client. ### Claude Code ```bash claude mcp add --transport http fetter https://mcp.fetter.io/mcp ``` ### Codex ```bash codex mcp add fetter --url https://mcp.fetter.io/mcp ``` ### Other MCP Clients For any other MCP-compatible client, provide the following remote server URL using the HTTP transport: ``` https://mcp.fetter.io/mcp ``` ## Agent Usage Once installed, the Fetter MCP tools are available to your AI agent during coding sessions. The agent can call them automatically when adding or auditing dependencies; no explicit tool invocation is required in your prompts. **Example prompts** - "Add the latest safe version of requests to requirements.txt" - "Are there any known vulnerabilities in my current dependencies?" - "What is the most recent version of pillow with no CVEs?" - "Before pinning cryptography, check whether 42.0.5 is vulnerable" The agent selects the appropriate tool based on context: - Adding a new package: `most_recent_not_vulnerable` to find a safe version - Validating a specific pinned version: `is_vulnerable` for a definitive answer - Auditing an existing specifier: `lookup` to see affected versions ## `most_recent_not_vulnerable` Find the most recent version of a package that has no known vulnerabilities. Provide only a package name and the server will search recent releases for a safe version. Useful when pinning a dependency to the latest clean release. **Parameters** - `package_name` — package name only (no version specifier), e.g. `"requests"` **Example Request** ```json { "jsonrpc": "2.0", "method": "tools/call", "id": 2, "params": { "name": "most_recent_not_vulnerable", "arguments": { "name": "cryptography" } } } ``` **Example Response:** ```json { "jsonrpc": "2.0", "id": 2, "result": { "content": [], "structuredContent": { "package": "cryptography", "version": "46.0.5", "vulnerabilities": [], "vulnerable": false }, "isError": false } } ``` ## `is_vulnerable` Check if a specific package version has known vulnerabilities. Requires an exact version specifier. Returns vulnerability IDs, summaries, CVSS scores, severity ratings, and reference URLs. **Parameters** - `dep_spec` — exact version specifier, e.g. `"requests==2.31.0"` **Example Request** ```json { "jsonrpc": "2.0", "method": "tools/call", "id": 2, "params": { "name": "is_vulnerable", "arguments": { "name": "requests==2.19.1" } } } ``` **Example Response:** ```json { "jsonrpc": "2.0", "id": 2, "result": { "content": [], "structuredContent": { "package": "requests", "version": "2.19.1", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" }, { "cvss_score": 5.6, "id": "GHSA-9wx4-h78v-vm56", "severity": "(Medium):", "summary": "Requests Session object does not verify requests after making first request with verify=False", "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56" }, { "cvss_score": 6.1, "id": "GHSA-j8r2-6x86-q33q", "severity": "(Medium):", "summary": "Unintended leak of Proxy-Authorization header in requests", "url": "https://osv.dev/vulnerability/GHSA-j8r2-6x86-q33q" }, { "cvss_score": 7.5, "id": "GHSA-x84v-xcm2-53pg", "severity": "(High):", "summary": "Insufficiently Protected Credentials in Requests", "url": "https://osv.dev/vulnerability/GHSA-x84v-xcm2-53pg" }, { "cvss_score": null, "id": "PYSEC-2018-28", "severity": null, "summary": "", "url": "https://osv.dev/vulnerability/PYSEC-2018-28" }, { "cvss_score": null, "id": "PYSEC-2023-74", "severity": null, "summary": "", "url": "https://osv.dev/vulnerability/PYSEC-2023-74" } ], "vulnerable": true }, "isError": false } } ``` ## `lookup` Look up a package by name and optional version specifier to find which versions are available and whether they have known vulnerabilities. Supports specifiers such as `"requests"`, `"numpy>=2.0"`, or `"flask==3.0.0"`. **Parameters** - `dep_specs` — package name or version specifier - `cvss_threshold` — filter to vulnerabilities at or above this CVSS score (0–10) - `max_observed_score` — return only the highest CVSS score per version rather than all individual vulnerabilities - `count` — limit the number of recent versions checked - `retain_passing` — include versions with no known vulnerabilities in the results **Example Request** ```json { "jsonrpc": "2.0", "method": "tools/call", "id": 2, "params": { "name": "lookup", "arguments": { "name": "requests>=2.32.0", "retain_passing": true } } } ``` **Example Response:** ```json { "jsonrpc": "2.0", "id": 2, "result": { "content": [], "structuredContent": { "package": "requests", "versions": [ { "version": "2.32.0", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" } ], "vulnerable": true }, { "version": "2.32.1", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" } ], "vulnerable": true }, { "version": "2.32.2", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" } ], "vulnerable": true }, { "version": "2.32.3", "vulnerabilities": [ { "cvss_score": 5.3, "id": "GHSA-9hjg-9r4m-mvj7", "severity": "(Medium):", "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs", "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7" } ], "vulnerable": true }, { "version": "2.32.4", "vulnerabilities": [], "vulnerable": false }, { "version": "2.32.5", "vulnerabilities": [], "vulnerable": false } ] }, "isError": false } } ```