TridentChain Security

io.github.DevInder1Published by GitHub account DevInder1v0.1.5Updated Oct 24, 2026

Local supply-chain CVE scanner via OSV/NVD. Scans deps and IDE extensions. No upload.

The publisher's own server: Agent.chain.tokyo Address Contracts

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local-first MCP server that scans project dependencies, developer tools and IDE extensions for known vulnerabilities using OSV, NVD, GHSA and Sonatype data.

What you can do
Scan project dependencies, system packages and IDE extensions for known CVEs, with full, quick and offline profiles and KEV/EPSS prioritization of findings. Run scans from the assistant and get a summary of results, with output written to a chosen output directory. Validate results after a patch through a validation tool. Optionally enrich coverage with advisory sources when extra tokens are configured.
When to use it
Useful when you want an assistant to check a codebase's dependencies and local developer tooling for known vulnerabilities, or to re-check findings after applying fixes, without sending project data to a hosted service.
Requirements
Runs as a local stdio process. Install the PyPI package tridentchain-mcp (Python 3.10+), or run it via uvx or the published Docker image. No API key is required for default use; network access is needed except in the offline profile. Optional environment variables NVD_API_KEY, GITHUB_TOKEN and SONATYPE_TOKEN improve coverage.
Before you install
Scans read the project path you point it at, so scope it to the intended directory. Default profiles contact OSV and NVD over the network; the offline profile avoids this. Optional tokens such as NVD_API_KEY, GITHUB_TOKEN and SONATYPE_TOKEN are secrets and should be kept out of shared configuration. The README states no upload, but verify this for your setup.

Installation

In SourceWeft

  1. Open TridentChain Security in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

TridentChain Security

[PyPI — tridentchain-security] [PyPI — tridentchain-mcp] [PyPI Downloads] [MCP Registry] [Python] [License: MIT] [Works with Claude · Cursor · VS Code · Windsurf · Zed] [Docker (ghcr.io)]

[TridentChain Security MCP server]

Local-first vulnerability scanner for project dependencies, developer tools, and IDE extensions.
Uses multi-source intelligence (OSV, NVD, GHSA, Sonatype) with KEV/EPSS prioritization.

No API key required for default usage.

Public repo: https://github.com/DevInder1/supply-chain-scanner-public

Install (plug and play)

bash
pip3 install tridentchain-securitynpm install -g @tridentchain/security-clitridentchain-security --help

Agents & MCP (Claude, Cursor, VS Code, Windsurf, Zed):

Pick whichever install path fits:

bash
# Option A — pip (needs Python 3.10+)pip3 install -U "tridentchain-security>=0.1.4" "tridentchain-mcp>=0.1.4"
# Option B — uvx (no manual Python install; uv handles it)uvx tridentchain-mcp
# Option C — Docker (no Python needed, fully sandboxed)docker pull ghcr.io/devinder1/tridentchain-mcp:latest# Then in your MCP config, replace `python3 -m tridentchain_mcp` with:#   command: docker#   args: ["run", "--rm", "-i", "-v", "$PWD:/workspace", "ghcr.io/devinder1/tridentchain-mcp:latest"]

What you can do: docs/CAPABILITIES.md
Full guide: docs/INSTALL_AND_USE.md
Cross-platform (macOS / Linux / Windows): docs/CROSS_PLATFORM.md
(PyPI: tridentchain-security · npm: @tridentchain/security-cli)

bash
tridentchain-security --scan all --project-path . --output-dir scanner-output

Use in your own Python app

python
from scanner import run_scan
summary = run_scan(    project_path=".",    scan="all",    run_profile="full",  # no API key required    output_dir="scanner-output",)print(summary["summary"])

Scan profiles

ProfileDescription
full (default)Project + system + extensions. OSV + NVD without keys.
quickFaster project-focused scan.
offlineLocal advisory DB only, no network.
Power-userAdd GITHUB_TOKEN, NVD_API_KEY, optional SONATYPE_TOKEN for best coverage.

Desktop app (individual application)

No repo clone required if the pip package is installed:

bash
pip3 install tridentchain-securitycd apps/desktop && npm install && npm run start

See apps/desktop/README.md and docs/DISTRIBUTION_VERIFICATION.md.

AI / automation (Claude, OpenAI, Cursor, VS Code, Windsurf, …)

One install, every agent: pip install "tridentchain-security>=0.1.2" tridentchain-mcp

GuideDescription
Agent integrationsClaude · OpenAI · Cursor · VS Code · Windsurf · Zed · MCP · CLI
CapabilitiesEverything you can do today
ArchitectureMCP + unified tools design
bash
./scripts/setup-agent-mcp.sh cursor   # prints setup for your agent

Phase 2 — Claude MCP: pip install tridentchain-mcp · Setup guide · Plugin

Phase 3 — OpenAI + Cursor: examples/openai/ · Cursor setup · .cursor/mcp.json.example

Phase 4 — VS Code (Anthropic MCP): Open repo → MCP ready · VS Code setup · ./scripts/vscode-mcp-install-link.sh · extension

Phase 5 — Validate: tridentchain-security --validate · MCP validate_after_patch · CAPABILITIES.md

Unified tool layer: from scanner.integrations import execute_tool, get_tool_definitions, to_openai_tools

Development

bash
git clone https://github.com/DevInder1/supply-chain-scanner-public.gitcd supply-chain-scanner-publicpython3 -m pip install -e .tridentchain-security --helppython3 -m unittest scanner.tests.test_matcher_ranges -v

Install & use: docs/INSTALL_AND_USE.md
Cross-platform: docs/CROSS_PLATFORM.md
CLI contract: docs/cli-contract.md
Publishing: docs/PUBLISHING.md

Optional API keys (power users)

VariablePurpose
NVD_API_KEYHigher NVD rate limits
GITHUB_TOKENGHSA advisories
SONATYPE_TOKENSonatype Guide advisories

Set in .env or environment variables.

License

MIT — see LICENSE

Source: README.md at commit 7cd7277

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.5LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Chain integrations

Agent.chain.tokyo Address Contracts

tokyo.chain.agentOfficial publisher

Lets an assistant rent a Japan mailing address for an agent: browse locations and floors, create a 55 USDC payment intent, and track contracts and events.

Streamable HTTPWeb executable
Location & Lifestyle9 toolsOct 30, 2026

Zovo Countdown Chain

Published by GitHub account theluckystrike

Generates a printable countdown calendar to one event — month pages, paper-chain strips or tear-off cards — plus an ICS reminder file.

Streamable HTTPWeb executable
Productivity & Workflow1 toolNov 8, 2026

DeviceChain

io.devicechain

Read-only MCP tools for a self-hosted DeviceChain IoT instance, letting an assistant inspect devices, telemetry and alarms.

Streamable HTTPWeb executable
Cloud & InfrastructureNot indexed yetNov 7, 2026

BridgePilot — cross-chain route quotes

Published by GitHub account ert1981

BridgePilot — cross-chain route quotes's hosted MCP server; no sign-in required; Streamable HTTP; 1 tool.

Streamable HTTPWeb executable
1 toolOct 30, 2026

BrainChain

com.usebrainchain

Lets an assistant hand a task brief to a frontier model hired and graded by an AI agent, paying in USDG or USDC only for work that passes the quality levels…

STDIODesktop only
FinanceNot validated yetNov 7, 2026