Aris Kg

aris-kg

Coding agents answer from training data that stops months before you use them. aris-kg connects them to the Aris knowledge graph instead: more than 15 million concepts, refreshed daily from NVD, OSV, GitHub security advisories, MITRE ATT&CK, OWASP and framework releases.

It comes three ways:

• An MCP server for Claude Code, Cursor, Codex, Windsurf and any other MCP client.
• A CLI that checks every pinned version in your lockfiles against known CVEs.
• A GitHub Action that fails a pull request when it adds a vulnerable dependency.

The code is open source (MIT). The graph is a paid API: you need a key from youraris.com/account, and each call is billed to your Aris credits.

Every account is limited to 120 calls a minute.

MCP server

The server gives your agent five tools, and tells it to use them without being asked: before adding a dependency, for any CVE, when picking a library version, and before writing auth, crypto, SQL or file-path code.

Claude Code

claude mcp add aris -e ARIS_API_KEY=your-key -- npx -y aris-kg mcp

Cursor, Windsurf and other JSON-configured clients

{  "mcpServers": {    "aris": {      "command": "npx",      "args": ["-y", "aris-kg", "mcp"],      "env": { "ARIS_API_KEY": "your-key" }    }  }}

Codex

In ~/.codex/config.toml:

[mcp_servers.aris]command = "npx"args = ["-y", "aris-kg", "mcp"]env = { ARIS_API_KEY = "your-key" }

CLI

export ARIS_API_KEY=your-key
npx aris-kg audit                   # lockfiles in the current foldernpx aris-kg audit ./service --fail-on criticalnpx aris-kg audit --json > report.jsonnpx aris-kg search cve CVE-2024-3094

audit reads these lockfiles. It only checks exact versions, so use a lockfile rather than a manifest with ranges.

aris_check_dependencies and the API take any of these ecosystems: npm, pypi, crates, go, maven, rubygems, packagist, nuget, hex, pub and swift. The graph also covers OSV's Hackage, CRAN, ConanCenter, Linux kernel and GitHub Actions advisories, searchable with aris_search_cve.

It exits with 1 when a vulnerability is at or above --fail-on (default high), or is exploited in the wild at any severity. --fail-on none never fails. Errors exit with 2.

GitHub Action

name: Dependency auditon: [pull_request]jobs:  aris:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: kennysarnoski-jarvis/aris-kg@v0        with:          api-key: ${{ secrets.ARIS_API_KEY }}          fail-on: high

As a library

import { ArisClient } from "aris-kg";
const aris = new ArisClient({ apiKey: process.env.ARIS_API_KEY! });const report = await aris.checkDependencies([{ name: "lodash", version: "4.17.20", ecosystem: "npm" }]);

Development

npm installnpm testnpm run buildnode dist/bin.js --help

Set ARIS_BASE_URL to point the client at another server.

License

MIT