Fetter MCP

fetter-io/fetter-mcp

Gives your AI agent live access to Python package vulnerability data from PyPI and OSV so it can make safer dependency choices while coding. You get three tools: most_recent_not_vulnerable finds the latest clean release of a package, is_vulnerable checks if a specific pinned version has known CVEs, and lookup shows which versions in a range are affected. The agent calls them automatically when you ask it to add dependencies, audit a requirements file, or pin a version. Responses include CVE IDs, CVSS scores, severity ratings, and links to full advisories. Runs as a remote HTTP server at mcp.fetter.io, so there's nothing to install locally.

GitHub stars: 1
tools: 3
transport: HTTP
last updated: Feb 26, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://mcp.fetter.io/mcp --name fetter-mcp

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http fetter-mcp https://mcp.fetter.io/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 3 tools

Verified live against the running server on Nov 6, 2026.

most_recent_not_vulnerableFind the most recent version of a package that has no known vulnerabilities.1 params

Find the most recent version of a package that has no known vulnerabilities.

Parameters* required

name*string

The package name to look up (e.g., "requests", "numpy", "flask").

lookupLook up a package by name and (optionally) version number to find which versions are available and/or have vulnerabilities.4 params

Look up a package by name and (optionally) version number to find which versions are available and/or have vulnerabilities.

Parameters* required

cvss_filterstring

CVSS score filter: "all" to show all vulnerabilities, "max" to show only the maximum observed score, or a number (0.0-10.0) to filter by threshold

limitinteger

When the name is not an exact version, limit the number of recent versions to check.

name*string

The package name to look up (e.g., "requests", "numpy>=2.0", "flask==3.0.0"). Note that when an exact "==" version is specified, the `limit` and `retain_passing` parameters have no effect.

retain_passingboolean

'When the name is not an exact version, setting this to True will return refernces for all packages, include those with no vulnerabilities (default: false)

is_vulnerableCheck if a specific package version has known vulnerabilities. Requires an exact version specifier (e.g., 'requests==2.31.0').1 params

Check if a specific package version has known vulnerabilities. Requires an exact version specifier (e.g., 'requests==2.31.0').

Parameters* required

name*string

The exact package name and version (e.g., "requests==2.31.0", "numpy==1.24.0").

Readme

Fetter MCP

Fetter provides a remote Model Context Protocol (MCP) server at https://mcp.fetter.io/mcp that gives AI coding agents real-time access to Python package vulnerability data. Built on fetter, it queries PyPI and OSV to surface known CVEs, CVSS scores, and safe versions so your agent can make informed dependency decisions as it writes code.

Tools:

most_recent_not_vulnerable: find the latest release of a package that is free of known vulnerabilities
is_vulnerable: check whether a specific pinned version has known CVEs
lookup: find available versions and their vulnerabilities for any package or specifier

Installation

The Fetter MCP server uses the HTTP transport and requires no local installation. Just register the remote URL with your MCP client.

Claude Code

claude mcp add --transport http fetter https://mcp.fetter.io/mcp

Codex

codex mcp add fetter --url https://mcp.fetter.io/mcp

Other MCP Clients

For any other MCP-compatible client, provide the following remote server URL using the HTTP transport:

View the full README on GitHub

Details

Repository: github.com/fetter-io/fetter-mcp
Website: fetter.io/mcp
Categories: Security & Pentesting, Data & Analytics
Transport: HTTP
Registry: MCP registry, active
Tools verified: Nov 6, 2026

Related Security & Pentesting MCP servers

View all

Recon Kit Mcpnan786521/recon-mcpRead-only network & security recon tools (DNS, TLS, headers, CORS) for AI agents, each graded.1stars

mcp-armorstudiomeyer-io/mcp-armorSecurity sidecar for MCP servers: 11 read-only control-plane tools for prompt-injection checks.1stars

Mcpnode-man/dechonet-mcp30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.1stars

GhostFreeshane-js/ghostfreeMCP server that scans your repo's dependencies for security vulnerabilities based on published CVEs.1stars

Securityscorecard Mcpcallmarcus/security-scorecard-mcpCommunity-built, comprehensive MCP server for the SecurityScorecard API (unofficial).0stars

Obsidian Mcp Securedewtech-technologies/obsidian-mcp-secureSecure MCP server for Obsidian with OWASP Top 10 controls and full audit logging.0stars