Aris Kg
Current CVEs, advisories, framework releases and reference code from a 15M-concept graph.
- tools
- 5
- auth
- Secret needed
- transport
- STDIO
- env var
- 1
- last updated
- Nov 7, 2026
Tools
5 toolsPublic tool metadata for what this MCP can expose to an agent.
aris_check_dependenciesChecks exact package versions: CVE ids, severity, CVSS, affected and fixed versions, and whether a CVE is exploited in the wild
Checks exact package versions: CVE ids, severity, CVSS, affected and fixed versions, and whether a CVE is exploited in the wild
No parameter schema in public metadata yet.
aris_search_cveFinds CVEs and GitHub advisories by id or description
Finds CVEs and GitHub advisories by id or description
No parameter schema in public metadata yet.
aris_search_knowledgeCurrent major versions and setup patterns, attack techniques, mitigations and known pitfalls
Current major versions and setup patterns, attack techniques, mitigations and known pitfalls
No parameter schema in public metadata yet.
aris_search_codeReference code from published packages
Reference code from published packages
No parameter schema in public metadata yet.
aris_web_searchAnything newer than the graph, with source URLs
Anything newer than the graph, with source URLs
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageConfiguration
ARIS_API_KEY*secretYour API key from youraris.com/account. Calls are billed to your Aris credits.
Readme
aris-kg
Coding agents answer from training data that stops months before you use them. aris-kg connects
them to the Aris knowledge graph instead: more than 15 million concepts, refreshed daily from NVD,
OSV, GitHub security advisories, MITRE ATT&CK, OWASP and framework releases.
It comes three ways:
- An MCP server for Claude Code, Cursor, Codex, Windsurf and any other MCP client.
- A CLI that checks every pinned version in your lockfiles against known CVEs.
- A GitHub Action that fails a pull request when it adds a vulnerable dependency.
The code is open source (MIT). The graph is a paid API: you need a key from youraris.com/account, and each call is billed to your Aris credits.
| Call | Price |
|---|---|
| CVE, knowledge or code search | 1¢ |
| Dependency check | 1¢ per package |
| Web search | 2¢ |
Every account is limited to 120 calls a minute.
MCP server
The server gives your agent five tools, and tells it to use them without being asked: before adding a dependency, for any CVE, when picking a library version, and before writing auth, crypto, SQL or file-path code.
Details
- Repository
- github.com/kennysarnoski-jarvis/aris-kg
- Website
- youraris.com
- Package
aris-kg- Transport
- STDIO
- Auth
- Required
- Registry
- MCP registry, active