Aris Kg

io.github.kennysarnoski-jarvisPublished by GitHub account kennysarnoski-jarvisv0.2.0Updated Nov 7, 2026

Current CVEs, advisories, framework releases and reference code from a 15M-concept graph.

VerifiedSTDIODesktop onlyKnowledge & MemoryDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Connects coding agents to the Aris knowledge graph for current CVEs, advisories, framework releases and reference code.

What you can do
  • Check exact package versions for CVE ids, severity, CVSS, affected and fixed versions, and in-the-wild exploitation
  • Find CVEs and GitHub advisories by id or description
  • Look up current major versions, setup patterns, attack techniques, mitigations and pitfalls
  • Retrieve reference code from published packages
  • Search the web for anything newer than the graph, with source URLs
When to use it
Useful when an agent picks library versions, adds dependencies, or writes auth, crypto, SQL or file-path code and should check known vulnerabilities first. Also fits teams that want lockfile audits or a pull request check that fails on vulnerable dependencies.
Requirements
Runs locally over stdio via npx (Node.js). Requires an Aris API key in the ARIS_API_KEY environment variable, obtained from the provider's account page. Network access to the Aris API; calls are billed to Aris credits and limited to 120 calls per minute.
Before you install
The graph is a paid API: each call costs credits (1¢ for CVE, knowledge or code search and per dependency checked, 2¢ for web search), so agent-initiated calls spend money. The ARIS_API_KEY secret is passed in the client configuration. Queries, including package names and search terms, are sent to the Aris service.

Installation

In SourceWeft

  1. Open Aris Kg in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

aris-kg

Coding agents answer from training data that stops months before you use them. aris-kg connects them to the Aris knowledge graph instead: more than 15 million concepts, refreshed daily from NVD, OSV, GitHub security advisories, MITRE ATT&CK, OWASP and framework releases.

It comes three ways:

  • An MCP server for Claude Code, Cursor, Codex, Windsurf and any other MCP client.
  • A CLI that checks every pinned version in your lockfiles against known CVEs.
  • A GitHub Action that fails a pull request when it adds a vulnerable dependency.

The code is open source (MIT). The graph is a paid API: you need a key from youraris.com/account, and each call is billed to your Aris credits.

CallPrice
CVE, knowledge or code search1¢
Dependency check1¢ per package
Web search2¢

Every account is limited to 120 calls a minute.

MCP server

The server gives your agent five tools, and tells it to use them without being asked: before adding a dependency, for any CVE, when picking a library version, and before writing auth, crypto, SQL or file-path code.

ToolWhat it does
aris_check_dependenciesChecks exact package versions: CVE ids, severity, CVSS, affected and fixed versions, and whether a CVE is exploited in the wild
aris_search_cveFinds CVEs and GitHub advisories by id or description
aris_search_knowledgeCurrent major versions and setup patterns, attack techniques, mitigations and known pitfalls
aris_search_codeReference code from published packages
aris_web_searchAnything newer than the graph, with source URLs

Claude Code

bash
claude mcp add aris -e ARIS_API_KEY=your-key -- npx -y aris-kg mcp

Cursor, Windsurf and other JSON-configured clients

json
{  "mcpServers": {    "aris": {      "command": "npx",      "args": ["-y", "aris-kg", "mcp"],      "env": { "ARIS_API_KEY": "your-key" }    }  }}

Codex

In ~/.codex/config.toml:

toml
[mcp_servers.aris]command = "npx"args = ["-y", "aris-kg", "mcp"]env = { ARIS_API_KEY = "your-key" }

CLI

bash
export ARIS_API_KEY=your-key
npx aris-kg audit                   # lockfiles in the current foldernpx aris-kg audit ./service --fail-on criticalnpx aris-kg audit --json > report.jsonnpx aris-kg search cve CVE-2024-3094

audit reads these lockfiles. It only checks exact versions, so use a lockfile rather than a manifest with ranges.

EcosystemLockfiles
npmpackage-lock.json, pnpm-lock.yaml, yarn.lock
Pythonpoetry.lock, uv.lock, Pipfile.lock, requirements.txt (pinned == lines)
RustCargo.lock
Gogo.mod
Java and Kotlin (Maven)gradle.lockfile
RubyGemfile.lock
PHPcomposer.lock
.NETpackages.lock.json
Elixirmix.lock
Dart and Flutterpubspec.lock
SwiftPackage.resolved

aris_check_dependencies and the API take any of these ecosystems: npm, pypi, crates, go, maven, rubygems, packagist, nuget, hex, pub and swift. The graph also covers OSV's Hackage, CRAN, ConanCenter, Linux kernel and GitHub Actions advisories, searchable with aris_search_cve.

It exits with 1 when a vulnerability is at or above --fail-on (default high), or is exploited in the wild at any severity. --fail-on none never fails. Errors exit with 2.

GitHub Action

yaml
name: Dependency auditon: [pull_request]jobs:  aris:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: kennysarnoski-jarvis/aris-kg@v0        with:          api-key: ${{ secrets.ARIS_API_KEY }}          fail-on: high

As a library

ts
import { ArisClient } from "aris-kg";
const aris = new ArisClient({ apiKey: process.env.ARIS_API_KEY! });const report = await aris.checkDependencies([{ name: "lodash", version: "4.17.20", ecosystem: "npm" }]);

Development

bash
npm installnpm testnpm run buildnode dist/bin.js --help

Set ARIS_BASE_URL to point the client at another server.

License

MIT

Source: README.md at commit b6ba59d

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.0LatestNov 7, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts