Fetter MCP

Fetter MCP

Fetter 提供远程 Model Context Protocol（MCP）服务，地址为 https://mcp.fetter.io/mcp，可让 AI 编码 Agent 实时访问 Python 包漏洞数据。它基于 fetter 构建，通过查询 PyPI 和 OSV，展示已知 CVE、CVSS 评分和安全版本，帮助 Agent 在编写代码时做出明智的依赖决策。

工具：

• most_recent_not_vulnerable：查找没有已知漏洞的最新包版本
• is_vulnerable：检查指定的固定版本是否存在已知 CVE
• lookup：查找任意包或版本说明符的可用版本及其漏洞

安装

Fetter MCP 服务使用 HTTP 传输，无需本地安装。只需向 MCP 客户端注册远程 URL。

Claude Code

claude mcp add --transport http fetter https://mcp.fetter.io/mcp

Codex

codex mcp add fetter --url https://mcp.fetter.io/mcp

其他 MCP 客户端

对于任何其他兼容 MCP 的客户端，使用 HTTP 传输提供以下远程服务 URL：

https://mcp.fetter.io/mcp

Agent 用法

安装后，Fetter MCP 工具即可在编码会话期间供 AI Agent 使用。添加或审计依赖时，Agent 可以自动调用这些工具；无需在提示词中明确要求调用工具。

提示词示例

• “将 requests 的最新安全版本添加到 requirements.txt”
• “我当前的依赖中是否存在已知漏洞？”
• “pillow 中没有 CVE 的最新版本是什么？”
• “固定 cryptography 版本之前，检查一下 42.0.5 是否存在漏洞”

Agent 会根据上下文选择合适的工具：

• 添加新包：使用 most_recent_not_vulnerable 查找安全版本
• 验证指定的固定版本：使用 is_vulnerable 获取明确结果
• 审计现有版本说明符：使用 lookup 查看受影响的版本

most_recent_not_vulnerable

查找没有已知漏洞的最新包版本。只需提供包名，服务就会搜索近期发布的版本，找到安全版本。适用于将依赖固定到最新的安全版本。

参数

• package_name — 仅包名（不含版本说明符），例如 "requests"

请求示例

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 2,
  "params": {
    "name": "most_recent_not_vulnerable",
    "arguments": {
      "name": "cryptography"
    }
  }
}

响应示例：

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [],
    "structuredContent": {
      "package": "cryptography",
      "version": "46.0.5",
      "vulnerabilities": [],
      "vulnerable": false
    },
    "isError": false
  }
}

is_vulnerable

检查指定的包版本是否存在已知漏洞。需要提供精确的版本说明符。返回漏洞 ID、摘要、CVSS 评分、严重性评级和参考 URL。

参数

• dep_spec — 精确的版本说明符，例如 "requests==2.31.0"

请求示例

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 2,
  "params": {
    "name": "is_vulnerable",
    "arguments": {
      "name": "requests==2.19.1"
    }
  }
}

响应示例：

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [],
    "structuredContent": {
      "package": "requests",
      "version": "2.19.1",
      "vulnerabilities": [
        {
          "cvss_score": 5.3,
          "id": "GHSA-9hjg-9r4m-mvj7",
          "severity": "(Medium):",
          "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
          "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
        },
        {
          "cvss_score": 5.6,
          "id": "GHSA-9wx4-h78v-vm56",
          "severity": "(Medium):",
          "summary": "Requests Session object does not verify requests after making first request with verify=False",
          "url": "https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56"
        },
        {
          "cvss_score": 6.1,
          "id": "GHSA-j8r2-6x86-q33q",
          "severity": "(Medium):",
          "summary": "Unintended leak of Proxy-Authorization header in requests",
          "url": "https://osv.dev/vulnerability/GHSA-j8r2-6x86-q33q"
        },
        {
          "cvss_score": 7.5,
          "id": "GHSA-x84v-xcm2-53pg",
          "severity": "(High):",
          "summary": "Insufficiently Protected Credentials in Requests",
          "url": "https://osv.dev/vulnerability/GHSA-x84v-xcm2-53pg"
        },
        {
          "cvss_score": null,
          "id": "PYSEC-2018-28",
          "severity": null,
          "summary": "",
          "url": "https://osv.dev/vulnerability/PYSEC-2018-28"
        },
        {
          "cvss_score": null,
          "id": "PYSEC-2023-74",
          "severity": null,
          "summary": "",
          "url": "https://osv.dev/vulnerability/PYSEC-2023-74"
        }
      ],
      "vulnerable": true
    },
    "isError": false
  }
}

lookup

根据包名和可选的版本说明符查找包，了解有哪些可用版本以及它们是否存在已知漏洞。支持 "requests"、"numpy>=2.0" 或 "flask==3.0.0" 等说明符。

参数

• dep_specs — 包名或版本说明符
• cvss_threshold — 筛选 CVSS 评分达到或高于此值的漏洞（0–10）
• max_observed_score — 每个版本仅返回最高 CVSS 评分，而不是所有单个漏洞
• count — 限制检查的近期版本数量
• retain_passing — 在结果中包含没有已知漏洞的版本

请求示例

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "id": 2,
  "params": {
    "name": "lookup",
    "arguments": {
      "name": "requests>=2.32.0",
      "retain_passing": true
    }
  }
}

响应示例：

{
  "jsonrpc": "2.0",
  "id": 2,
  "result": {
    "content": [],
    "structuredContent": {
      "package": "requests",
      "versions": [
        {
          "version": "2.32.0",
          "vulnerabilities": [
            {
              "cvss_score": 5.3,
              "id": "GHSA-9hjg-9r4m-mvj7",
              "severity": "(Medium):",
              "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
              "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
            }
          ],
          "vulnerable": true
        },
        {
          "version": "2.32.1",
          "vulnerabilities": [
            {
              "cvss_score": 5.3,
              "id": "GHSA-9hjg-9r4m-mvj7",
              "severity": "(Medium):",
              "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
              "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
            }
          ],
          "vulnerable": true
        },
        {
          "version": "2.32.2",
          "vulnerabilities": [
            {
              "cvss_score": 5.3,
              "id": "GHSA-9hjg-9r4m-mvj7",
              "severity": "(Medium):",
              "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
              "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
            }
          ],
          "vulnerable": true
        },
        {
          "version": "2.32.3",
          "vulnerabilities": [
            {
              "cvss_score": 5.3,
              "id": "GHSA-9hjg-9r4m-mvj7",
              "severity": "(Medium):",
              "summary": "Requests vulnerable to .netrc credentials leak via malicious URLs",
              "url": "https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7"
            }
          ],
          "vulnerable": true
        },
        {
          "version": "2.32.4",
          "vulnerabilities": [],
          "vulnerable": false
        },
        {
          "version": "2.32.5",
          "vulnerabilities": [],
          "vulnerable": false
        }
      ]
    },
    "isError": false
  }
}