#supply-chain

Deterministic, machine-readable CVE and supply chain risk data for infrastructure, PyPI, and npm packages. Built for AI agents and coding assistants to act on directly, no CVSS interpretation required. Covers nginx, PostgreSQL, Redis, Docker, Kubernetes, and more.

Security scanner for MCP servers — vet an MCP before you wire it into an agent. Detects prompt-injection, credential exfiltration (via taint analysis), RCE, and supply-chain risks, and catches cross-server exfil chains no single server reveals. Zero-dependency local CLI, SARIF output, CI-gateable, no account.

Track ocean containers across 200+ shipping lines by container, bill of lading, or booking number — live milestones, vessel positions, ETAs, and demurrage & detention free time. Remote streamable-HTTP server with a public demo key (no signup). Learn more at https://trackingmcp.com.

MCP server for independent humanoid-robot intelligence. Query viability scores, specs, pricing and deployment status, plus supply-chain teardowns across three layers: semiconductor, mechanical and software BOM. Free PUBLIC tier (one X-API-Key, also valid on the REST API) covers robot discovery and profiles; premium unlocks per-robot BOM, supply-chain dependency graphs, geopolitical concentration and single-source risk. No manufacturer ties — the only cross-layer robot supply-chain source an AI agent can query.

Daily, Ed25519-signed security intelligence for AI-agent stacks: CVEs, supply-chain incidents and advisories (GHSA/CISA-KEV/OSV/NVD + national-CERT) assessed for MCP/LLM-proxy impact, cross-validated and signed. Paid via x402 ($0.10 USDC on Base); free sample, list_available, check_affected, get_since.

Kubova packs cargo into shipping containers and onto pallets and returns a verifiable 3D loading plan — exact coordinates, fit, utilization, weight balance. Over MCP, an assistant can request a plan and act on the structured result. Free tier; public REST API too.

A Model Context Protocol (MCP) server connecting AI agents to the Polygon Mainnet blockchain to verify product origin, track supply chain events, and query IPFS certificates.

Pre-install risk gate for npm packages. Stops AI coding agents from running malicious or typosquatted packages before lifecycle scripts run.

A small MCP server for coding agents. Catches dead model IDs, dependencies with open CVEs, and end-of-life runtimes — the things training data is months stale on — before the agent ships broken code. Free, no auth, stateless. Three tools, three output modes, auditable {as_of, sources[]} on every response.

LiveDataLink is a hosted MCP server giving AI agents 182 real-time data tools across 36 domains through a single Streamable HTTP endpoint. Coverage includes sanctions screening (OFAC + UN + EU + BIS DPL first-party indexed), SEC EDGAR, federal courts plus Caselaw Access Project, IRS nonprofits, NPPES healthcare providers, USAspending federal awards, Federal Register + eCFR regulations, CVE + threat intel (RDAP, IP reputation, FBI Wanted, CISA KEV), FRED + BLS + US Treasury + World Bank macro, EIA + NREL energy, Zillow real estate, Texas parcels, ClinicalTrials.gov, FDA, EPA, FEC, FMCSA trucking, USPTO patents, Census, federal recreation (RIDB), Project Gutenberg books, OpenAlex scholarly, NPM + PyPI + cargo + GitHub supply-chain intel, and more. One bearer token, one endpoint, one bill. Built for compliance + due diligence + agentic research workflows. Free tier (100 queries/month, no credit card) available at https://livedatalink.ai/signup/free. Paid plans from $10/month. Open MCP protocol, portable keys, no lock-in. Operated by Blackbox Foundry LLC out of Texas.

Enterprise supply chain intelligence APIs with 100 free calls/day. Live data: freight rates (85+ carriers), port congestion (16 global ports via NOAA), shipping lanes, commodity prices, crypto, forex, economic indicators (FRED), AI inference, blockchain monitoring. x402 micropayments, on-chain trust tiers on Polygon. npm install @cerebrochain/bot-sdk

24 MCP tools for ocean shipping intelligence — D&D tariffs, freight rates, surcharges, local charges, port congestion, vessel schedules, and risk scoring across 11 carriers and 157 countries. Free tier available.

Scan MCP servers for security risks before your AI agent trusts them. Detects prompt injection, supply chain attacks (including the LiteLLM 1.82.7/1.82.8 backdoor), excessive permissions, arbitrary code execution, typosquatting, and tool shadowing. Add to your .mcp.json and let your agent audit its own tools with tooltrust_scan_config.

Security scanner for AI Agent skills, plugins, and MCP servers. 39+ detection rules with AST taint tracking, A-F grading, and post-uninstall residue cleanup.

Open-source MCP server for logistics. Runs inside your security perimeter — connects to TMS, ERP, email, and documents. Gives AI agents deep context about shipments, carriers, rates, and routes without data leaving your infrastructure.

TEOS MCP is an MCP server that performs real-time diff-level security scanning for AI agents and CI/CD pipelines. It analyzes code diffs before merge or deployment and returns a deterministic gate decision: ALLOW WARN BLOCK Built for: • AI agents • Autonomous systems • DevSecOps teams • CI/CD workflows Features: • Diff risk scoring • Deterministic merge gate • Real-time enforcement • Usage-based monetization (pay-per-scan) • Optional on-chain verification Unlike gateway filters, TEOS MCP performs code-level intelligence before execution.

Security scanner MCP server that protects AI coding agents from generating vulnerable code. Uses tree-sitter AST analysis to detect OWASP Top 10 vulnerabilities, hardcoded secrets, and prompt injection attacks. Includes package hallucination detection across 4.3M packages (npm, PyPI, RubyGems, crates.io, pub.dev, CPAN, Raku). Works with Claude Desktop, Claude Code, Cursor, Cline, and any MCP-compatible client. Full feature list (for detailed descriptions): • 275+ security rules covering Python, JavaScript, TypeScript, Java, Go, Ruby, PHP, C/C++, Rust, C#, Terraform, Kubernetes • AST-based detection with tree-sitter (falls back to regex when unavailable) • Taint analysis for tracking user input to dangerous sinks • Package hallucination detection: verifies 4.3M+ packages across 7 ecosystems • Prompt injection detection: blocks exfiltration, jailbreaks, and malicious instructions • Automatic fix suggestions for common vulnerabilities • Zero config: works instantly with npx • CWE/OWASP metadata for compliance reporting

A reference implementation of the SchemaPin protocol for cryptographically signing and verifying AI agent tool schemas to prevent supply-chain attacks.