{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_mva6bygss5pf","handle":"mcp-server-vdb","url":"https://wellknown.network/agents/mcp-server-vdb","links":{"self":"https://wellknown.network/agents/mcp-server-vdb/record.json","html":"https://wellknown.network/agents/mcp-server-vdb","markdown":"https://wellknown.network/agents/mcp-server-vdb/record.md","api":"https://wellknown.network/api/v1/agents/mcp-server-vdb","status":"https://wellknown.network/api/v1/agents/mcp-server-vdb/status","claim":"https://wellknown.network/agents/mcp-server-vdb/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/mcp-server-vdb/claim.json","badge":"https://wellknown.network/agents/mcp-server-vdb/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/mcp-server-vdb/history","tools":"https://wellknown.network/api/v1/agents/mcp-server-vdb/tools"},"ard":{"identifier":"urn:air::server:mcp-server-vdb","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"mcp-server-vdb","summary":"AppThreat Vulnerability Database MCP server","description":"# Introduction\n\nThis folder contains the source code for running VDB as a Model Context Protocol (MCP) server. Below you can find the configuration for running the VDB MCP server with Claude Desktop. Please feel free to share the configuration for other [clients](https://modelcontextprotocol.io/clients) via pull requests.\n\n## What is available\n\nThe MCP server provides:\n\n- Structured JSON tool results with summaries and machine-readable evidence.\n- Bulk search tools for package lists and CycloneDX BOMs.\n- Filter-aware search for severity thresholds, sources (`osv`, `nvd`, `github`, `aqua`), date ranges, malware-only / exclude-malware, package scope (`app_only`, `os_only`), package ecosystem, and pagination.\n- Metadata and full-text search over aliases, references, package names, descriptions, and affected functions/modules.\n- Resource templates such as `cve://{id}` and `purl://{purl}`.\n- Concrete resources such as `vdb://metadata`, `vdb://health`, `vdb://sources`, and `vdb://malware/latest`.\n- A `db_refresh` tool that fetches or refreshes local data through the same staged, validated, atomically-swapped path as `vdb db refresh` — `{\"target\": \"full\"}` (optionally `app_only` or an `image` URL override), `{\"target\": \"shards\", \"shards\": [\"npm\", \"pypi\"]}`, or `{\"target\": \"sync\"}` (the default: refresh everything already local). Every result carries the post-refresh health report.\n- Richer prompts for package-risk assessment, CVE triage, SBOM summaries, fix prioritization, version-match explanations, and overlay review.\n\n### VDB 7 shard stores, coverage, and health\n\nVDB 7 data can be a full database under `VDB_HOME` or a set of type shards (see the root [README type-shard section](../../README.md#type-shard-databases-v7-preview)). The server is honest about which one it has:\n\n- Every tool payload carries a `status`: `ok`, `coverage_gap` (some requested purl types have no local shard — those results were NOT checked), or `stale_data` (a shard lags its siblings by more than…","publisher":null,"homepage":null,"repository":null,"version":"7.0.4","license":"MIT","protocols":["mcp"],"tags":["mcp"],"pricing":null,"endpoints":[{"url":"pypi:mcp-server-vdb","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","summary":"pypi","version":"pypi","description":"pypi"}},"derived":{"capabilities":[{"slug":"dev.package-management","name":"Packages & Dependencies","confidence":1,"provenance":"derived"},{"slug":"dev.version-control","name":"Version Control","confidence":0.848,"provenance":"derived"},{"slug":"code.security-review","name":"Security Review","confidence":0.814,"provenance":"derived"}],"categories":["code","dev"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"mcp-server-vdb","registry":"pypi","observedAt":"2026-11-09T18:26:07.116Z","publishedAt":"2026-11-03T18:09:51.939284Z","latestVersion":"7.0.4"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"mcp-server-vdb","url":"https://pypi.org/project/mcp-server-vdb/","firstSeenAt":"2026-09-10T04:22:42.614Z","fetchedAt":"2026-11-09T18:24:39.175Z","normalizedAt":"2026-11-09T18:24:39.175Z"}]},"firstSeenAt":"2026-09-10T04:22:42.614Z","updatedAt":"2026-11-09T18:26:07.116Z"}