Dependency Vulnerability Tracker — package security advisories ($0.01/query)

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-08T16:11:50.114133Z",
      "publishedAt": "2026-11-08T16:11:50.114133Z",
      "statusChangedAt": "2026-11-08T16:11:50.114133Z"
    }
  },
  "server": {
    "name": "com.a2awire/data-dependency-vulnerability-malicious-package-security",
    "_meta": {
      "io.modelcontextprotocol.registry/publisher-provided": {
        "price": "$0.01/query. Free testnet USDC via testnet faucet.",
        "cadence": "Continuous refresh; republished on hourly tick (new advisories + severity/patched-version revisions re-emit rows)",
        "product": "Tracks newly published and updated GitHub Security Advisories (GHSA) — the ecosystem-specific vulnerability feed dependency-audit agents actually need: per-package vulnerable version ranges and first_patched_version for npm, pip, Go, Composer, Cargo, Maven, NuGet and more, plus G",
        "how_to_buy": "birth (one EIP-712-signed call) -> fund your wallet (testnet faucet) -> data_session_open -> data_session_funding_package -> broadcast -> data_session_attach_escrow -> data_session_query",
        "mcp_remote": "https://a2awire.com/mcp/data/ghsawatch-package-dependency-vulnerabilities-malicious-package-advisories-d21673/http",
        "settlement": "escrow-backed on Base L2; funds never custodied by the platform",
        "listing_page": "https://a2awire.com/data/ghsawatch-package-dependency-vulnerabilities-malicious-package-advisories-d21673",
        "verification": "on-chain corpus-root anchor evidence via /api/v1/anchors/{tx_hash}",
        "sample_queries": [
          "What package dependency vulnerabilities were published recently?",
          "Are there new critical vulnerabilities in npm or pip packages with patched versions?",
          "Which malicious packages were flagged as malware lately?"
        ],
        "getting_started": [
          "connect (no key needed) — initialize returns buyer-first instructions",
          "birth — one EIP-712-signed POST /api/v1/birth mints your agent identity + wallet + api_key in one shot (no signup); the kit is shown once — persist it",
          "get testnet funds — the free faucet drips USDC to your birth wallet (a2awire.com — see llms.txt)",
          "data_session_open — open a prepaid $0.01/query session",
          "data_session_query — ask; attested hits returned"
        ],
        "search_keywords": "[redacted]"
      }
    },
    "title": "Dependency Vulnerability Tracker — package security advisories ($0.01/query)",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "remotes": [
      {
        "url": "https://a2awire.com/mcp/data/ghsawatch-package-dependency-vulnerabilities-malicious-package-advisories-d21673/http",
        "type": "streamable-http"
      }
    ],
    "version": "0.1.2",
    "repository": {
      "url": "https://github.com/ee324/a2awire",
      "source": "github"
    },
    "websiteUrl": "https://a2awire.com/data/ghsawatch-package-dependency-vulnerabilities-malicious-package-advisories-d21673",
    "description": "Dependency vulns & malicious-package advisories. Be born in one call — free testnet funds."
  }
}