Security tools for coding agents: dependency advisory audits and evidence for remediation.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Use Purple to audit sanitized npm/pnpm dependency metadata for known advisory matches and checked upgrade paths. Resume deferred targets with remediation.planning.next while retaining the full scan and coordinating plans across pages. Does not read source, run tests, edit files, confirm exploitability or use a model key.
Locally sanitized npm v2/v3 or pnpm v6/v9 lockfile metadata. The server cannot read local paths. Do not send source, credentials or registry URLs.
Use remediation.planning.next unchanged with the same sanitized files to continue planning. This checks only selected planning targets; retain and merge the original full advisory report.
Maximum affected package/version pairs to plan in this response, highest severity first. Zero scans only. Follow remediation.planning.next for remaining targets; omitted or failed paths remain explicit blockers.
Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.
claude mcp add --transport http offense https://offense.sh/mcp
Use Purple to audit sanitized npm/pnpm dependency metadata for known advisory matches and checked upgrade paths. Resume deferred targets with remediation.planning.next while retaining the full scan and coordinating plans across pages. Does not read source, run tests, edit files, confirm exploitability or use a model key.
| Argument | Type | Description |
|---|---|---|
| files* | array | Locally sanitized npm v2/v3 or pnpm v6/v9 lockfile metadata. The server cannot read local paths. Do not send source, credentials or registry URLs. |
| planning | object | Use remediation.planning.next unchanged with the same sanitized files to continue planning. This checks only selected planning targets; retain and merge the original full advisory report. |
| planLimit | integer | Maximum affected package/version pairs to plan in this response, highest severity first. Zero scans only. Follow remediation.planning.next for remaining targets; omitted or failed paths remain explicit blockers. |
{
"type": "object",
"required": [
"files"
],
"properties": {
"files": {
"type": "array",
"items": {
"type": "object",
"required": [
"path",
"content"
],
"properties": {
"path": {
"type": "string",
"maxLength": 240,
"description": "Unique relative lockfile path."
},
"content": {
"anyOf": [
{
"type": "string",
"maxLength": 2000000
},
{
"type": "object"
}
],
"description": "Sanitized lockfile document; use the installed Offense helper to prepare it."
}
},
"additionalProperties": false
},
"maxItems": 20,
"minItems": 1,
"description": "Locally sanitized npm v2/v3 or pnpm v6/v9 lockfile metadata. The server cannot read local paths. Do not send source, credentials or registry URLs."
},
"planning": {
"type": "object",
"required": [
"metadataFingerprint",
"pendingTargetIds"
],
"properties": {
"pendingTargetIds": {
"type": "array",
"items": {
"type": "string",
"pattern": "^[a-f0-9]{64}$"
},
"maxItems": 5000,
"minItems": 1,
"uniqueItems": true
},
"metadataFingerprint": {
"type": "string",
"pattern": "^[a-f0-9]{64}$"
}
},
"description": "Use remediation.planning.next unchanged with the same sanitized files to continue planning. This checks only selected planning targets; retain and merge the original full advisory report.",
"additionalProperties": false
},
"planLimit": {
"type": "integer",
"default": 3,
"maximum": 10,
"minimum": 0,
"description": "Maximum affected package/version pairs to plan in this response, highest severity first. Zero scans only. Follow remediation.planning.next for remaining targets; omitted or failed paths remain explicit blockers."
}
},
"additionalProperties": false
}We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Oct 31, 2026.