TridentChain Security
Scan project dependencies and IDE extensions for known CVEs locally via OSV/NVD before you ship, without uploading your manifest to a cloud scanner.
Overview
TridentChain Security is an MCP server for the Ship phase that locally scans dependencies and IDE extensions for CVEs using OSV and NVD without uploading your project data.
What is this MCP server?
- Local CVE scanning using OSV and NVD data sources
- Scans application dependencies and IDE extension inventory
- No upload of lockfiles or extension lists to a remote service
- PyPI package tridentchain-mcp with stdio MCP transport (v0.1.4)
- Open-source scanner repo on GitHub (supply-chain-scanner-public)
- Version 0.1.4 on PyPI identifier tridentchain-mcp
- Data sources OSV and NVD per description
- Scans both application dependencies and IDE extensions
What problem does it solve?
Before launch you need to know which packages or IDE extensions carry known CVEs, but cloud scanners often require uploading sensitive dependency graphs.
Who is it for?
Indie developers and small teams who want agent-triggered, privacy-preserving supply-chain CVE checks on deps and editor extensions pre-release.
Skip if: Organizations needing signed SBOM governance, license compliance suites, or active runtime intrusion detection—this is local CVE lookup, not full GRC.
What do I get? / Deliverables
After installing tridentchain-mcp and enabling stdio MCP, your agent can run local OSV/NVD-backed scans and act on CVE findings before you ship.
- Local CVE findings for dependencies and IDE extensions via MCP tools
- No requirement to upload project files to a third-party scan service
Recommended MCP Servers
Journey fit
Shipping safely includes knowing whether your dependency tree or editor extensions carry published CVEs; TridentChain targets that gate in the Ship phase. Security subphase covers supply-chain and vulnerability checks; a local OSV/NVD-backed scanner fits pre-release and CI-adjacent workflows.
How it compares
Local supply-chain CVE MCP scanner, not a cloud code review skill or infrastructure monitoring dashboard.
Common Questions / FAQ
Who is TridentChain Security for?
Solo builders and small teams using MCP agents who need local vulnerability scanning on dependencies and IDE extensions before shipping.
When should I use TridentChain Security?
Use it in the ship security step when you are cutting a release or hardening a repo and want OSV/NVD CVE coverage without sending lockfiles to a remote scanner.
How do I add TridentChain Security to my agent?
Install the PyPI package tridentchain-mcp (v0.1.4), configure your MCP client to launch it over stdio, and invoke its scan tools from Claude Code, Cursor, or Codex.