Fetter MCP

io.github.fetter-io由 GitHub 账号 fetter-io 发布v1.0.1更新于 Oct 24, 2026

Real-time Python package and vulnerability data for AI coding agents.

已验证Streamable HTTP可网页运行开发者工具安全与监控

概览

AI 生成的概览

一个远程 MCP 服务器，为编码助手提供来自 PyPI 和 OSV 的实时 Python 包版本与漏洞数据。

可以做什么
按包名或版本说明符查询可用版本及其已知漏洞，可按 CVSS 阈值过滤、只返回最高分、限制检查版本数，并可选保留无漏洞版本。检查某个精确固定版本是否存在已知 CVE，返回编号、摘要、CVSS 分数、严重级别和参考链接。查找某包无已知漏洞的最新版本。
适用场景
适合助手在添加、固定或审计 Python 依赖时使用，以便选择没有已知 CVE 的版本，或报告现有依赖清单中的漏洞。
运行要求
远程 HTTP 端点，无需本地安装或软件包。在支持 HTTP 传输的 MCP 客户端中注册服务器地址。未声明认证、环境变量或请求头。需要能访问该端点的网络。
安装前请注意
仅做只读查询，不会写入或安装任何内容。查询的包名和版本说明符会发送到该远程服务，再由其查询 PyPI 和 OSV。漏洞数据来自这些来源，可能不完整或滞后于最新公告，固定关键依赖前请自行核实。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Fetter MCP，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Web executable，通过 Streamable HTTP。 远程服务在工作区中配置后即可从网页运行时运行。

交给智能体安装

把这段提示词粘贴到 Claude Code、Codex、Cursor 等智能体，或 SourceWeft 对话中。智能体会读取该服务器的安装指南，先向你展示发布者、端点和登录方式，经你同意后再把它添加到你的客户端。密钥不会写进任何命令。

阅读 https://sourceweft.com/mcp/io.github.fetter-io%2Ffetter-mcp/install.md，并按其中说明把这个 MCP 服务器接入我的客户端。修改任何配置之前，先告诉我它的发布者、端点和登录方式，等我确认。不要把 API 密钥写进命令或我会提交的文件；问我密钥应从哪里获取。

查看智能体所依据的安装指南

其他 MCP 客户端

把它添加到你客户端的 mcpServers 配置中。

{
  "mcpServers": {
    "fetter": {
      "type": "http",
      "url": "https://mcp.fetter.io/mcp"
    }
  }
}

README

Fetter MCP

Fetter provides a remote Model Context Protocol (MCP) server at https://mcp.fetter.io/mcp that gives AI coding agents real-time access to Python package vulnerability data. Built on fetter, it queries PyPI and OSV to surface known CVEs, CVSS scores, and safe versions so your agent can make informed dependency decisions as it writes code.

Tools:

  • most_recent_not_vulnerable: find the latest release of a package that is free of known vulnerabilities
  • is_vulnerable: check whether a specific pinned version has known CVEs
  • lookup: find available versions and their vulnerabilities for any package or specifier

Installation

The Fetter MCP server uses the HTTP transport and requires no local installation. Just register the remote URL with your MCP client.

Claude Code

bash
claude mcp add --transport http fetter https://mcp.fetter.io/mcp

Codex

bash
codex mcp add fetter --url https://mcp.fetter.io/mcp

Other MCP Clients

For any other MCP-compatible client, provide the following remote server URL using the HTTP transport:

https://mcp.fetter.io/mcp

Agent Usage

Once installed, the Fetter MCP tools are available to your AI agent during coding sessions. The agent can call them automatically when adding or auditing dependencies; no explicit tool invocation is required in your prompts.

Example prompts

  • "Add the latest safe version of requests to requirements.txt"
  • "Are there any known vulnerabilities in my current dependencies?"
  • "What is the most recent version of pillow with no CVEs?"
  • "Before pinning cryptography, check whether 42.0.5 is vulnerable"

The agent selects the appropriate tool based on context:

  • Adding a new package: most_recent_not_vulnerable to find a safe version
  • Validating a specific pinned version: is_vulnerable for a definitive answer
  • Auditing an existing specifier: lookup to see affected versions

most_recent_not_vulnerable

Find the most recent version of a package that has no known vulnerabilities. Provide only a package name and the server will search recent releases for a safe version. Useful when pinning a dependency to the latest clean release.

Parameters

  • package_name — package name only (no version specifier), e.g. "requests"

Example Request

json
{  "jsonrpc": "2.0",  "method": "tools/call",  "id": 2,  "params": {    "name": "most_recent_not_vulnerable",    "arguments": {      "name": "cryptography"    }  }}

Example Response:

json
{  "jsonrpc": "2.0",  "id": 2,  "result": {    "content": [],    "structuredContent": {      "package": "cryptography",      "version": "46.0.5",      "vulnerabilities": [],      "vulnerable": false    },    "isError": false  }}

is_vulnerable

Check if a specific package version has known vulnerabilities. Requires an exact version specifier. Returns vulnerability IDs, summaries, CVSS scores, severity ratings, and reference URLs.

Parameters

  • dep_spec — exact version specifier, e.g. "requests==2.31.0"

Example Request

json
{  "jsonrpc": "2.0",  "method": "tools/call",  "id": 2,  "params": {    "name": "is_vulnerable",    "arguments": {      "name": "requests==2.19.1"    }  }}

Example Response:

json
{  "jsonrpc": "2.0",  "id": 2,  "result": {    "content": [],    "structuredContent": {      "package": "requests",      "version": "2.19.1",      "vulnerabilities": [        {          "cvss_score": 5.3,          "id": "GHSA-9hjg-9r4m-mvj7",          "severity": "(Medium):",          "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",          "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"        },        {          "cvss_score": 5.6,          "id": "GHSA-9wx4-h78v-vm56",          "severity": "(Medium):",          "summary": "Requests Session object does not verify requests after making first request with verify=False",          "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56"        },        {          "cvss_score": 6.1,          "id": "GHSA-j8r2-6x86-q33q",          "severity": "(Medium):",          "summary": "Unintended leak of Proxy-Authorization header in requests",          "url": "https://osv.dev/vulnerability/GHSA-j8r2-6x86-q33q"        },        {          "cvss_score": 7.5,          "id": "GHSA-x84v-xcm2-53pg",          "severity": "(High):",          "summary": "Insufficiently Protected Credentials in Requests",          "url": "https://osv.dev/vulnerability/GHSA-x84v-xcm2-53pg"        },        {          "cvss_score": null,          "id": "PYSEC-2018-28",          "severity": null,          "summary": "",          "url": "https://osv.dev/vulnerability/PYSEC-2018-28"        },        {          "cvss_score": null,          "id": "PYSEC-2023-74",          "severity": null,          "summary": "",          "url": "https://osv.dev/vulnerability/PYSEC-2023-74"        }      ],      "vulnerable": true    },    "isError": false  }}

lookup

Look up a package by name and optional version specifier to find which versions are available and whether they have known vulnerabilities. Supports specifiers such as "requests", "numpy>=2.0", or "flask==3.0.0".

Parameters

  • dep_specs — package name or version specifier
  • cvss_threshold — filter to vulnerabilities at or above this CVSS score (0–10)
  • max_observed_score — return only the highest CVSS score per version rather than all individual vulnerabilities
  • count — limit the number of recent versions checked
  • retain_passing — include versions with no known vulnerabilities in the results

Example Request

json
{  "jsonrpc": "2.0",  "method": "tools/call",  "id": 2,  "params": {    "name": "lookup",    "arguments": {      "name": "requests>=2.32.0",      "retain_passing": true    }  }}

Example Response:

json
{  "jsonrpc": "2.0",  "id": 2,  "result": {    "content": [],    "structuredContent": {      "package": "requests",      "versions": [        {          "version": "2.32.0",          "vulnerabilities": [            {              "cvss_score": 5.3,              "id": "GHSA-9hjg-9r4m-mvj7",              "severity": "(Medium):",              "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",              "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"            }          ],          "vulnerable": true        },        {          "version": "2.32.1",          "vulnerabilities": [            {              "cvss_score": 5.3,              "id": "GHSA-9hjg-9r4m-mvj7",              "severity": "(Medium):",              "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",              "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"            }          ],          "vulnerable": true        },        {          "version": "2.32.2",          "vulnerabilities": [            {              "cvss_score": 5.3,              "id": "GHSA-9hjg-9r4m-mvj7",              "severity": "(Medium):",              "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",              "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"            }          ],          "vulnerable": true        },        {          "version": "2.32.3",          "vulnerabilities": [            {              "cvss_score": 5.3,              "id": "GHSA-9hjg-9r4m-mvj7",              "severity": "(Medium):",              "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",              "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"            }          ],          "vulnerable": true        },        {          "version": "2.32.4",          "vulnerabilities": [],          "vulnerable": false        },        {          "version": "2.32.5",          "vulnerabilities": [],          "vulnerable": false        }      ]    },    "isError": false  }}

来源：README.md，提交 5811ae9

工具

3

lookup

Look up a package by name and (optionally) version number to find which versions are available and/or have vulnerabilities.

输入参数name必填limitcvss_filterretain_passing

is_vulnerable

Check if a specific package version has known vulnerabilities. Requires an exact version specifier (e.g., 'requests==2.31.0').

输入参数name必填

most_recent_not_vulnerable

Find the most recent version of a package that has no known vulnerabilities.

输入参数name必填

版本历史

1
  1. v1.0.1最新Sep 16, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通必需25 分
  • 已声明认证方式必需10 分
  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。